Signature Detail

HTTP: Internet Explorer Refresh URL Overflow

This signature detects attempts to exploit a known vulnerability against all versions of Windows 95 and 98. Attackers can use an overly long filename to crash the system or execute arbitrary code.

Extended Description

There is a overflowable buffer in the networking code for Windows 95 and 98 (all versions). The buffer is in the part of the code that handles filenames. By specifying an exceptionally long filename, an attacker can cause the machine to crash or execute arbitrary code. This vulnerability could be exploited remotely by including a hostile UNC or file:// URL in a web page or HTML email. The attack would occur when the page was loaded in a browser or the email was opened (including opening the email in a preview pane.)

Affected Products

• Microsoft Windows 95
• Microsoft Windows 98 A
• Microsoft Windows 98 B
• Microsoft Windows 98
• Microsoft Windows 98SE

References

• BugTraq: 779
• CVE: CVE-2000-0330
• URL: http://www.microsoft.com/technet/security/bulletin/ms99-049.mspx