Microsoft Internet Explorer 拖放操作存在文件安装漏洞

Microsoft Internet Explorer 拖放操作存在文件安装漏洞

发布时间：2004-08-18
更新时间：2004-08-18
严重程度：中
威胁程度：隐蔽攻击
错误类型：访问验证错误
利用方式：客户机模式

BUGTRAQ ID：10973

受影响系统

    vulnerable Microsoft Internet Explorer 5.5 SP2
       - Microsoft Windows 2000 Advanced Server
       - Microsoft Windows 2000 Advanced Server SP1
       - Microsoft Windows 2000 Advanced Server SP2
       - Microsoft Windows 2000 Datacenter Server
       - Microsoft Windows 2000 Datacenter Server SP1
       - Microsoft Windows 2000 Datacenter Server SP2
       - Microsoft Windows 2000 Professional
       - Microsoft Windows 2000 Professional SP1
       - Microsoft Windows 2000 Professional SP2
       - Microsoft Windows 2000 Server
       - Microsoft Windows 2000 Server SP1
       - Microsoft Windows 2000 Server SP2
       - Microsoft Windows 2000 Terminal Services
       - Microsoft Windows 2000 Terminal Services SP1
       - Microsoft Windows 2000 Terminal Services SP2
       - Microsoft Windows 95
       - Microsoft Windows 98
       - Microsoft Windows 98SE
       - Microsoft Windows ME
       - Microsoft Windows NT Enterprise Server 4.0
       - Microsoft Windows NT Enterprise Server 4.0 SP1
       - Microsoft Windows NT Enterprise Server 4.0 SP2
       - Microsoft Windows NT Enterprise Server 4.0 SP3
       - Microsoft Windows NT Enterprise Server 4.0 SP4
       - Microsoft Windows NT Enterprise Server 4.0 SP5
       - Microsoft Windows NT Enterprise Server 4.0 SP6
       - Microsoft Windows NT Enterprise Server 4.0 SP6a
       - Microsoft Windows NT Server 4.0
       - Microsoft Windows NT Server 4.0 SP1
       - Microsoft Windows NT Server 4.0 SP2
       - Microsoft Windows NT Server 4.0 SP3
       - Microsoft Windows NT Server 4.0 SP4
       - Microsoft Windows NT Server 4.0 SP5
       - Microsoft Windows NT Server 4.0 SP6
       - Microsoft Windows NT Server 4.0 SP6a
       - Microsoft Windows NT Terminal Server 4.0
       - Microsoft Windows NT Terminal Server 4.0 SP1
       - Microsoft Windows NT Terminal Server 4.0 SP2
       - Microsoft Windows NT Terminal Server 4.0 SP3
       - Microsoft Windows NT Terminal Server 4.0 SP4
       - Microsoft Windows NT Terminal Server 4.0 SP5
       - Microsoft Windows NT Terminal Server 4.0 SP6
       - Microsoft Windows NT Workstation 4.0
       - Microsoft Windows NT Workstation 4.0 SP1
       - Microsoft Windows NT Workstation 4.0 SP2
       - Microsoft Windows NT Workstation 4.0 SP3
       - Microsoft Windows NT Workstation 4.0 SP4
       - Microsoft Windows NT Workstation 4.0 SP5
       - Microsoft Windows NT Workstation 4.0 SP6
       - Microsoft Windows NT Workstation 4.0 SP6a
    Microsoft Internet Explorer 5.5 SP1
       - Microsoft Windows 2000 Advanced Server
       - Microsoft Windows 2000 Advanced Server SP1
       - Microsoft Windows 2000 Advanced Server SP2
       - Microsoft Windows 2000 Datacenter Server
       - Microsoft Windows 2000 Datacenter Server SP1
       - Microsoft Windows 2000 Datacenter Server SP2
       - Microsoft Windows 2000 Professional
       - Microsoft Windows 2000 Professional SP1
       - Microsoft Windows 2000 Professional SP2
       - Microsoft Windows 2000 Server
       - Microsoft Windows 2000 Server SP1
       - Microsoft Windows 2000 Server SP2
       - Microsoft Windows 2000 Terminal Services
       - Microsoft Windows 2000 Terminal Services SP1
       - Microsoft Windows 2000 Terminal Services SP2
       - Microsoft Windows 95
       - Microsoft Windows 98
       - Microsoft Windows NT Enterprise Server 4.0
       - Microsoft Windows NT Enterprise Server 4.0 SP1
       - Microsoft Windows NT Enterprise Server 4.0 SP2
       - Microsoft Windows NT Enterprise Server 4.0 SP3
       - Microsoft Windows NT Enterprise Server 4.0 SP4
       - Microsoft Windows NT Enterprise Server 4.0 SP5
       - Microsoft Windows NT Enterprise Server 4.0 SP6
       - Microsoft Windows NT Enterprise Server 4.0 SP6a
       - Microsoft Windows NT Server 4.0
       - Microsoft Windows NT Server 4.0 SP1
       - Microsoft Windows NT Server 4.0 SP2
       - Microsoft Windows NT Server 4.0 SP3
       - Microsoft Windows NT Server 4.0 SP4
       - Microsoft Windows NT Server 4.0 SP5
       - Microsoft Windows NT Server 4.0 SP6
       - Microsoft Windows NT Server 4.0 SP6a
       - Microsoft Windows NT Terminal Server 4.0
       - Microsoft Windows NT Terminal Server 4.0 SP1
       - Microsoft Windows NT Terminal Server 4.0 SP2
       - Microsoft Windows NT Terminal Server 4.0 SP3
       - Microsoft Windows NT Terminal Server 4.0 SP4
       - Microsoft Windows NT Terminal Server 4.0 SP5
       - Microsoft Windows NT Terminal Server 4.0 SP6
       - Microsoft Windows NT Workstation 4.0
       - Microsoft Windows NT Workstation 4.0 SP1
       - Microsoft Windows NT Workstation 4.0 SP2
       - Microsoft Windows NT Workstation 4.0 SP3
       - Microsoft Windows NT Workstation 4.0 SP4
       - Microsoft Windows NT Workstation 4.0 SP5
       - Microsoft Windows NT Workstation 4.0 SP6
       - Microsoft Windows NT Workstation 4.0 SP6a
    Microsoft Internet Explorer 5.5
       - Microsoft Windows 2000 Advanced Server
       - Microsoft Windows 2000 Advanced Server SP1
       - Microsoft Windows 2000 Advanced Server SP2
       - Microsoft Windows 2000 Datacenter Server
       - Microsoft Windows 2000 Datacenter Server SP1
       - Microsoft Windows 2000 Datacenter Server SP2
       - Microsoft Windows 2000 Professional
       - Microsoft Windows 2000 Professional SP1
       - Microsoft Windows 2000 Professional SP2
       - Microsoft Windows 2000 Server
       - Microsoft Windows 2000 Server SP1
       - Microsoft Windows 2000 Server SP2
       - Microsoft Windows 2000 Terminal Services
       - Microsoft Windows 2000 Terminal Services SP1
       - Microsoft Windows 2000 Terminal Services SP2
       - Microsoft Windows 95
       - Microsoft Windows 98
       + Microsoft Windows ME
       - Microsoft Windows NT Enterprise Server 4.0
       - Microsoft Windows NT Enterprise Server 4.0 SP1
       - Microsoft Windows NT Enterprise Server 4.0 SP2
       - Microsoft Windows NT Enterprise Server 4.0 SP3
       - Microsoft Windows NT Enterprise Server 4.0 SP4
       - Microsoft Windows NT Enterprise Server 4.0 SP5
       - Microsoft Windows NT Enterprise Server 4.0 SP6
       - Microsoft Windows NT Enterprise Server 4.0 SP6a
       - Microsoft Windows NT Server 4.0
       - Microsoft Windows NT Server 4.0 SP1
       - Microsoft Windows NT Server 4.0 SP2
       - Microsoft Windows NT Server 4.0 SP3
       - Microsoft Windows NT Server 4.0 SP4
       - Microsoft Windows NT Server 4.0 SP5
       - Microsoft Windows NT Server 4.0 SP6
       - Microsoft Windows NT Server 4.0 SP6a
       - Microsoft Windows NT Terminal Server 4.0
       - Microsoft Windows NT Terminal Server 4.0 SP1
       - Microsoft Windows NT Terminal Server 4.0 SP2
       - Microsoft Windows NT Terminal Server 4.0 SP3
       - Microsoft Windows NT Terminal Server 4.0 SP4
       - Microsoft Windows NT Terminal Server 4.0 SP5
       - Microsoft Windows NT Terminal Server 4.0 SP6
       - Microsoft Windows NT Workstation 4.0
       - Microsoft Windows NT Workstation 4.0 SP1
       - Microsoft Windows NT Workstation 4.0 SP2
       - Microsoft Windows NT Workstation 4.0 SP3
       - Microsoft Windows NT Workstation 4.0 SP4
       - Microsoft Windows NT Workstation 4.0 SP5
       - Microsoft Windows NT Workstation 4.0 SP6
       - Microsoft Windows NT Workstation 4.0 SP6a
    Microsoft Internet Explorer 6.0 SP1
    Microsoft Internet Explorer 6.0
       - Microsoft Windows 2000 Advanced Server
       - Microsoft Windows 2000 Advanced Server SP1
       - Microsoft Windows 2000 Advanced Server SP2
       - Microsoft Windows 2000 Datacenter Server
       - Microsoft Windows 2000 Datacenter Server SP1
       - Microsoft Windows 2000 Datacenter Server SP2
       - Microsoft Windows 2000 Professional
       - Microsoft Windows 2000 Professional SP1
       - Microsoft Windows 2000 Professional SP2
       - Microsoft Windows 2000 Server
       - Microsoft Windows 2000 Server SP1
       - Microsoft Windows 2000 Server SP2
       - Microsoft Windows 2000 Terminal Services
       - Microsoft Windows 2000 Terminal Services SP1
       - Microsoft Windows 2000 Terminal Services SP2
       - Microsoft Windows 98
       - Microsoft Windows 98SE
       - Microsoft Windows ME
       - Microsoft Windows NT Enterprise Server 4.0 SP6a
       - Microsoft Windows NT Server 4.0 SP6a
       - Microsoft Windows NT Workstation 4.0 SP6a
       + Microsoft Windows Server 2003 Datacenter Edition
       + Microsoft Windows Server 2003 Datacenter Edition 64-bit
       + Microsoft Windows Server 2003 Enterprise Edition
       + Microsoft Windows Server 2003 Enterprise Edition 64-bit
       + Microsoft Windows Server 2003 Standard Edition
       + Microsoft Windows Server 2003 Web Edition
       + Microsoft Windows XP Home
       + Microsoft Windows XP Professional

详细描述
Microsoft Internet Explorer被发现一新漏洞,该漏洞允许安装未论证的恶意可执行代码.
据报道, 在浏览器之间进行拖放操作可能被攻击者利用,导致在受害者计算机上安装文件到启动目录里.

攻击者可以利用该漏洞让受害者在不知不觉中安装软件.一旦恶意可执行文件被放到启动目录中,在计算机重新启动后将会被运行.

测试代码
http://www.malware.com/wottapoop.html

相关信息
http://www.securityfocus.com/bid/10973