Exploiting Microsoft Internet Explorer Cursor and Icon File Handling Vulnerability

This paper will focus on Microsoft .ANI file handling vulnerability, which was discovered by eEye Digital Security Company on November 15, 2004. The severity of this vulnerability was rated as 'high' both by Microsoft and eEye Digital Security Company because successful exploit of this flaw allows for remote code execution when a user visited a malicious web site or received a malicious HTML email. An attacker who successfully exploited this vulnerability could take complete control of an affected system. This first section of this paper will demonstrate in detail why Microsoft .ANI file handling is vulnerable and how the malicious code can take advantage of this vulnerability. Signatures of this attack and Snort rule are also provided.