CERT^® Advisory CA-2001-06 Automatic Execution of Embedded MIME Types

• All Windows versions of Microsoft Internet Explorer 5.5 SP1 or earlier, except IE 5.01 SP2, running on x86 platforms
• Any software which utilizes vulnerable versions of Internet Explorer to render HTML

Overview

There exists in Internet Explorer a table which is used to determine how IE handles MIME types when it encounters MIME parts in any type of HTML document, be it email message, newsgroup posting, web page, or local file. This table contains a set of entries that cause Internet Explorer to open the MIME part without giving the end user the opportunity to decide if the MIME part should be opened. This vulnerability allows an intruder to construct malicious content that, when viewed in Internet Explorer (or any program that uses the IE HTML rendering engine), can execute arbitrary code. It is not necessary to run an attachment; simply viewing the document in a vulnerable program is sufficient to execute arbitrary code.

II. Impact

Attackers can cause arbitrary code to be executed on a victim's system by embedding the code in a malicious email, or news message, or web page.

III. Solution

Apply the patch from Microsoft

Apply the patch from Microsoft, available at:

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this advisory. When vendors report new information to the CERT/CC, we update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.

Cyrusoft International, Inc.

Mulberry does not use Internet Explorer to render HTML within Mulberry itself and is not vulnerable to these kinds of problems. Users can save HTML attachments to disk and then view those in browsers susceptible to this problem, but this requires the direct intervention of the user to explicitly save to disk - simply viewing HTML in Mulberry does not expose users to these kinds of problems.

Our HTML rendering is a basic styled-text only renderer that does not execute any form of scripts. This is true on all the platforms we support: Win32, Mac OS (Classic & X), Solaris, linux.

An official statement about this is available on our website at:

Lotus Development Corporation

Notes doesn't use IE to display HTML formatted email.

If a user's browser preferences specify Notes with Internet Explorer, then the version of Internet Explorer that is installed on the user's workstation is used for browsing. It is launched as an ActiveX component within Notes, but Notes does not ship any IE code. If Internet Explorer is chosen as the user's preferred browser, then Notes launches Internet Explorer in a separate window and opens the link. The Notes client does not need to be upgraded but the user must upgrade their version of Internet Explorer to prevent against this vulnerability, which they should do anyway.

Microsoft Corporation

We have concluded that the bug, as described above, does NOT affect Netscape clients 4.x and 6.x for the following two reasons:

1. We ALWAYS verify that the user wants to open/launch the attachment with a link. The user must click this link to view/launch the attachment.
2. Also, we ALWAYS stay true to the MIME type given. Therefore, if someone sent a malicious .exe file, and manually changed the MIME type to image/gif, Netscape would open the file as a gif. The result would be garbled binary code.

As a result of our forced check for user authorization (bullet #1) we assume that the bug in question does not affect us.

Opera Software

Opera does not use Internet Explorer or any other external software to render HTML.

QUALCOMM Incorporated

It is unclear at this time what impact, if any, this vulnerability has on Eudora clients.

Appendix B. - References