Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Multiple vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer Date Published: 2006-09-07 Last Update: 2006-09-06 Advisory ID: CORE-2006-0322 Bugtraq ID: None currently assigned CVE Name: None currently assigned Title: Multiples vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer Class: Access Validation Error/Design Error, Input validation error Remotely Exploitable: Yes Locally Exploitable: Yes Advisory URL: http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id= 1510 *Vendors contacted:* America Online Inc. . 2006-07-27: Initial notification sent to vendor, advisory release date set for Aug. 14th. . 2006-07-27: Vendor response acknowledging notification. . 2006-08-11: Request for an update sent to vendor asking for an estimated date for fix availability. . 2006-08-14: Request for an update sent to vendor asking for an estimated date for fix availability, advisory release date now set for Aug. 22nd. . 2006-08-15: Vendor response received. Still determining when a fix will be available. A new update from the vendor forthcoming before Aug. 22nd. . 2006-08-16: Vendor email received requesting further technical details or proof-of-concept code. . 2006-08-17: Core response vendor: proof-of-concept for the ICQ client bug can not be made available as standalone program without incurring in a substantial development effort. . 2006-08-21: Vendor email describing coordination issues with ICQ development team. No fix schedule provided . 2006-08-21: In liue of proof-of-concept, Core provides succinct technical explanation of the problem in the ICQ 2003b client. . 2006-08-29: Updated advisory sent to vendor requesting comments and fix availability information. Advisory release date now set for Aug. 31st. . 2006-08-30: Vendor response received stating that 30 days is insufficient to fix bugs and reiterating the previously noted coordination and communications problems with engineering team at remote facilities. No tentative fix schedule made available, earliest date for an official vendor statement about fixes is Sept. 1st . 2006-08-30: Core response to vendor, publication of advisories will be delayed until Sept. 6th in order to receive offical statement from vendor. Baring a precise schedule that demonstrates an imminent release of fixes the publication date is final. . 2006-08-30: Vendor provides an official statement. . 2006-09-07: Advisory published. Release Mode: USER RELEASE *Vulnerability Description:* Security problems found in the ICQ Toolbar v1.3 may allow attackers to control and change configuration settings and to inject scripting code in RSS feed contents and execute it in the contetxt of the feed interface (IE's Local Zone) ICQ Toolbar 1.3 for Internet Explorer is a Browser Helper Object that provides several features including: search, pop-up blocker, ICQmail notifier, RSS feeds and others. The ICQ toolbar, is one of the various products offered by ICQ and it is available for download at http://download.icq.com/download/toolbar/ A problem was found in the way the ICQ Toolbar implements its web configuration interface that lets attackers controlling a malicious website change the ICQ toolbar's configuration settings without users of the ICQ toolbar for Internet Explorer noticing that an attack is taking place. Additionally, Cross Site Scripting vulnerabilities in the RSS Feeds interface could allow malicious RSS feeds to execute scripting code in the context of the Feeds interface, and allow attackers to access (and, in specific cases, change) configuration settings. *Vulnerable Packages:* The following AOL/ICQ software products are affected by these issues: Remote configuration vulnerability - ICQ Toolbar 1.3 for Internet Explorer Malicious RSS feed vulnerability - ICQ Toolbar 1.3 for Internet Explorer The ICQ Toolbar for Windows 98/ME was not included in our tests. Nevertheless, it is likely to be vulnerable. *Non-vulnerable Packages:* - ICQ Search Plugin for Mozilla / Firefox. *Solution/Vendor Information:* Statement provided by AOL Product Vulnerabilities team: "AOL has recently been made aware of two vulnerabilities in the various versions of the ICQ Toolbar. Successful exploitation of the first vulnerability may allow an attacker to alter non-critical configuration information for the Toolbar by tricking a user into visiting a malicious website. The second vulnerability affects versions of the ICQ Toolbar that have RSS feed capability. An attacker may be able to trick a user into loading a malicious RSS feed that contains malicious cross-site scripting code. Solutions / Workarounds: Remote configuration vulnerability - Users should carefully inspect the source of any web-based configuration files they use to configure their ICQ Toolbar. Malicious RSS feed vulnerability - Users are recommended to use the ICQ Toolbar 1.2 which is packaged with ICQ 5.1; ICQ Toolbar 1.2 does not have RSS feed capability." *Credits:* Luciana Tabo, Lucas Lavarello, Sebastian Cufre, Ezequiel Gutesman and Javier Garcia Di Palma from Core Security Technologies discovered and tested these vulnerabilities during Core Security?s Bugweek 2006. *Technical Description - Exploit/Concept Code:* [Web configuration Interface] The ICQ Toolbar provides a web-based configuration interface that is implemented through a plain simple HTML page. Whenever a user clicks on ?Toolbar Options,? Internet Explorer is directed to a local webpage called ?options2.html? that resides in the directory where the toolbar was installed. Most Internet Explorer toolbars in use are now providing web-based configuration interfaces that either take you to an online website or, as in this case, to a local page. In all of these cases, basic security mechanisms must be implemented to prevent attackers from crafting malicious web pages that could either change or read toolbar configuration settings. As mentioned before, the ICQ toolbar configuration web page provides a list of standard checklist controls that either enable or disable certain toolbar features when checked/unchecked by the user. Whenever one of these checklist controls is clicked, the toolbar internally handles the onClick event and carries out any corresponding actions. The first issue derives from the fact that the ICQ Toolbar isn't validating either the location or the originating source from where the configuration web page is loaded. Therefore, the toolbar can either be configured from the local system (as expected) or from anywhere in the online world. This enables anyone to simply copy the contents of the locally stored ?options2.html? file and place it as an html file hosted in any website, such as the attacker?s favorite .com domain. Secondly, the way in which each checkbox control is associated to a configuration setting is by simply matching the ID attribute of each HTML checkbox tag to a list of expected configuration IDs. This enables an attacker to change the external representation of a checkbox control in order to disguise an attack. As far as the ID attribute matches a corresponding configuration setting, the attacker can present to the user any HTML for rendering and presentation in the browser. By combining both problems, an attacker can easily read and change ICQ toolbar configuration settings. For example, here is what the checkbox for enabling automatic ICQ Toolbar updates looks like in the ?official? configuration interface (options2.html): <input type="checkbox" id="UpdateAutomatically"><font face="Tahoma" size="2">Update ICQ Toolbar automatically</font> The following checkbox will also work the same way: <input type="checkbox" id="UpdateAutomatically"><font face="Tahoma" size="2">I?m 21 years old or older.</font> In such a scenario, a commonly seen disclaimer page with a checkbox is used to disguise an attack that changes toolbar settings. Although we tried to automate the "clicking" process in order to skip the need of having the victim click on the checkbox control, the toolbar seems to actually require the user to generate the Click event. [Cross Site Scripting vulnerabilities in the RSS Feed module] Cross Site Scripting vulnerabilities were found in the RSS Feed module provided by the ICQ Toolbar for Internet Explorer. The issues emerge at the time of displaying items from an RSS feed and could provide attackers with a way to access or change configuration settings. Specifically, we found the title and description fields of the item element included in a standard RSS feed XML document to be ?vulnerable? to Cross Site Scripting vulnerabilities. The issue resides in the fact that the application is appending the contents of both fields directly in HTML output without first performing any sanitation or encoding on them. This would allow an attacker with control on the contents of these fields to insert Javascript code that will then be executed in the user's browser. We haven?t tested all possible RSS tags and therefore believe more tags may carry the same problem. A sample XML document describing a malicious RSS feed would look like this: <?xml version="1.0" encoding="iso-8859-1" ?> <rss version="2.0"> <channel> <title>Sample evil feed</title> <link>http://evilfeed</link> <description>This is a sample evil RSS feed!</description> <language>en-us</language> <item> <title>Stealing your RSS feeds!</title> <link>http://localhost</link> <description><img src="javascript:var url=parent.left.external.GetDataFile();var%20a=parent.left.load_xml(url) ;var b=parent.left.parse_tree_data(a, 0, url,'');alert(b)"></description> <pubDate>2006-07-20</pubDate> </item> </channel> </rss> The document above will show a MessageBox with the contents of the toolbar?s data file where the RSS feeds configuration are stored. An attacker could also: - Steal the contents of the RSS feeds configuration file. - Call toolbar methods from the ?external? object (RefreshRSS, OpenFeed, MarkAsRead, OpenRSSDialog, CloseRSSFrame, SetRSSNotificationFlag, OpenRSSNewDialog...) - Control the contents of the HTML document that is displayed to the client in order to trick the victim into several "classic" phishing attack scenarios. - etc. *Workaround:* Either remove or disable the toolbar in Internet Explorer. Note that hiding the toolbar through View->Toolbars and unchecking the ICQ toolbar option DOES NOT disable the toolbar; it just hides it. The toolbar can easily be removed through the 'Add or Remove Programs' snap-in provided by Windows's Control Panel or disabled by renaming the 'toolbaru.dll' from the toolbar's installation directory. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs/ *About Core Security Technologies* Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide. The company?s flagship product, CORE IMPACT, is the first automated penetration testing product for assessing specific information security threats to an organization. Penetration testing evaluates overall network security and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core augments its leading technology solution with world-class security consulting services, including penetration testing, software security auditing and related training. Based in Boston, MA. and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com. *DISCLAIMER:* The contents of this advisory are copyright (c) 2006 CORE Security Technologies and (c) 2006 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. $Id: ICQToolbar-advisory.txt,v 1.11 2006/09/07 19:56:16 carlos Exp $