MORE CRITICAL FLAWS IN MS WINDOWS EXPLORER

["Team Pwnge" <team_pwn4ge () outgun com>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TEAM PWN4GE Security Advisory                                     PWNED
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: HIGH
     Title: EXPLORER: Vulnerability in all versions of Windows Explorer
      Date: January 11, 2005

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple overflows have been found in Windows Explorer, potentially
allowing a remote user to open Explorer and run files remotely.


Background
==========

Windows Explorer is an advanced browsing tool made by Microsoft. It
is used in daily tasks to open folders, copy files, delete files, rename
files and view files on a system. It is the foundation of the World Wide
Web and used by billions worldwide. It runs on an array of machines.


Affected versions
=================

All versions of Windows' Explorer are vulnerable

Description
===========

Shogun Suzuki discovered that a remote user can connect to any
machine via numerous exploits and use Windows Explorer to view files,
rename files, delete files, change permissions on files stored on a
remote machine that has been pwned.

Impact
======

A remote attacker could install something similar to PCAnywhere
after exploiting Windows and use Windows' Explorer to view, copy
and or open any file on a victims machine.

Workaround
==========

On a command prompt: del C:\WINDOWS\explorer.exe


Concerns?
=========

Security is a primary focus of TEAM PWN4GE and ensuring the
progress of secure Windows machines be our dreams. As security
concerns should be addressed to respective vendors, we feel the
urge to bypass standards and bring our common dreams of a
secure homeland to the Interweb.

License
=======

Copyright 2005 TEAM PWN4GE

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0
-- 
_______________________________________________
Outgun.com free e-mail @ www.outgun.com 
Check out our Premium services - POP3 downloading, e-mail forwarding, and 25MB mailboxes!

Powered by Outblaze

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html