321920 - .wmf file starts windows media player

Status: VERIFIED DUPLICATE of bug 322319

(SeaMonkey :: Security, defect)

Description

[Hermann Schwab]

currently there is an exploit in the wild using .wmf files.
Firefox asks and starts irfanview if allowed to, Seamonkey doesn't ask and starts Windows Media Player, which can't display the file.
I checked helper applications both in Firefox and seamonkey and didn't find the .wmf extension, or irfanview. I however found Windows Media Player in the Helper Applications.

Spbanner.wmf is a printer separation file, from the default installation. It is shown in the directory with an irfanview icon. 
HKEY_CLASSES_ROOT\.wm  shows (standard) ASFFile and OpenWithList WMPlayer.exe
HKEY_CLASSES_ROOT\.wmf shows (standard) IrfanView.wmf
Firefox suggests to open with ASFFile (default) and opens using irfanview.

Comment 1

[Hermann Schwab]

http://secunia.com/advisories/18255/

I used the local file for testing, as I didn't want to test using the real exploit.
What I expect from Seamonkey: to be asked like Firefox does, what I want to do, open with ...  or save to disk.

Buggy behaviour on Firefox: If I check the box always open this file using ...
I don't know how to reset this setting, even if I would have remembered I was asked for ASFFile. Helper-Applications don't list the .wmf extension, or the .asf extension, nor Irfanview. It's just trial and error, I removed the action from .wm files.

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

can someone do a helper application log?

  set NSPR_LOG_MODULES=HelperAppService:5
  set NSPR_LOG_FILE=c:\helperapp.log

And attach the resulting log here?

Comment 3

[Hermann Schwab]

Attachment: HelperApplog Seamonkey

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051230 SeaMonkey/1.5a
file:///C:/WINDOWS/SYSTEM/Spbanner.wmf

Comment 4

[Hermann Schwab]

Attachment: HelperApplog Firefox

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8) Gecko/20051224 Firefox/1.5
file:///C:/WINDOWS/SYSTEM/Spbanner.wmf

Comment 5

[Hermann Schwab]

both logs made on the same computer running Win98 SP1 using the same local file file:///C:/WINDOWS/SYSTEM/Spbanner.wmf
Seamonkey is default browser, both browsers unstalled from zip (unzipped into new empty directory)

can somebody attach another wmf file so I can test remote, or is there a difference if the file is loaded locally or remote?

Comment 6

[Christian :Biesinger (don't email me, ping me on IRC)]

how odd, looks like windows maps video/x-ms-wm to "." as extension... 

What's the value of HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wm?


Also, what are the steps to reproduce? They ought to be in comment 0...

Comment 7

[Hermann Schwab]

(In reply to comment #6)
> how odd, looks like windows maps video/x-ms-wm to "." as extension... 
> 
> What's the value of HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wm?

HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wm
CLSID "{cd3afa92-b84f-48f0-9393-7edc34128127}"
Extension ".wm"

HKEY_CLASSES_ROOT\CLSID\{CD3AFA92-B84F-48F0-9393-7EDC34128127}
(Standard) "VIDEO__X_MS_WM Moniker Class"
HKEY_CLASSES_ROOT\CLSID\{CD3AFA92-B84F-48F0-9393-7EDC34128127}\DocObject
(Standard) "(no value)"
HKEY_CLASSES_ROOT\CLSID\{CD3AFA92-B84F-48F0-9393-7EDC34128127}\InprocServer32
(Standard) "C:\WINDOWS\SYSTEM\WMP.OCX"
ThreadingModel "apartment"
HKEY_CLASSES_ROOT\CLSID\{CD3AFA92-B84F-48F0-9393-7EDC34128127}\ProgID
(Standard) "WMPlayer.OCX.7"

Steps to Repeat:
1. Paste file:///C:/WINDOWS/SYSTEM/Spbanner.wmf into Location Bar
2. Press Enter
3. Watch action depending on browser and settings.

Should I upload that file?
Should I make logs of other browser versions?

Comment 8

[Christian :Biesinger (don't email me, ping me on IRC)]

you can ignore the CLSID stuff, mozilla doesn't look at that

Hm... so you don't have a HKEY_CLASSES_ROOT\.wm\Content Type entry, or a HKEY_CLASSES_ROOT\.wmf\Content Type one?

Can you attach the mimeTypes.rdf from your profile? (It contains your helper app settings)

Also, are those logs the complete files?

Comment 9

[Hermann Schwab]

(In reply to comment #8)
> you can ignore the CLSID stuff, mozilla doesn't look at that
> 
> Hm... so you don't have a HKEY_CLASSES_ROOT\.wm\Content Type entry, or a
> HKEY_CLASSES_ROOT\.wmf\Content Type one?
> 
> Can you attach the mimeTypes.rdf from your profile? (It contains your helper
> app settings)
> 
> Also, are those logs the complete files?

Those logs are the complete files, just renamed. I can make some new ones using new empty profiles, if wanted.

mimetypes.rdf from Firefox 1.5:
<?xml version="1.0"?>
<RDF:RDF xmlns:NC="http://home.netscape.com/NC-rdf#"
         xmlns:RDF="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
  <RDF:Seq RDF:about="urn:mimetypes:root">
    <RDF:li RDF:resource="urn:mimetype:video/x-ms-wm"/>
  </RDF:Seq>
  <RDF:Description RDF:about="urn:mimetypes">
    <NC:MIME-types RDF:resource="urn:mimetypes:root"/>
  </RDF:Description>
</RDF:RDF>


registry entries:

[HKEY_CLASSES_ROOT\.wm]
"Content Type"="video/x-ms-wm"
@="ASFFile"

[HKEY_CLASSES_ROOT\.wm\OpenWithList]

[HKEY_CLASSES_ROOT\.wm\OpenWithList\wmplayer.exe]

[HKEY_CLASSES_ROOT\.wmf]
@="IrfanView.wmf"

[HKEY_CLASSES_ROOT\.wmf\ShellEx]

[HKEY_CLASSES_ROOT\.wmf\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{7376D660-C583-11d0-A3A5-00C04FD706EC}"

Comment 10

[Hermann Schwab]

Attachment: mimeTypes.rdf SEAMONKEY

this file is from my normal long-time used profile, I currently don't have quicktime installed, etc.. but some things may be in there which have been installed some time ago.

Comment 11

[Hermann Schwab]

the german computer magazine c't offers a demo here (german text):
http://www.heise.de/security/dienste/browsercheck/demos/ie/wmf.shtml

the actual test link, when successful, opens windows calculator:
http://www.heise.de/security/dienste/browsercheck/demos/ie/wmfexp.php

you can ask for dummy virus mail:
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?kategorie=virendummies

WMF-mail here, fill in your address at the bottom of the page and submit
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=wmf
You don't get the testmail, but a mail which can vbe used to request the actual test mail.
Subject: URL für c't-Emailcheck   From: c't-Emailcheck

open the first link http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=wmf&email= your address && some cookie to get the mail. They are telling you a idstring they are putting into the subject so you know the mail is from them.
Mine was: pbstrnl
Subject: c't-Emailcheck: WMF (pbstnrl)

I saved the attachment wmfexp.jpg and opened it using seamonkey, no problem, no image, simply the name was rendered:
file:///C:/Eigene%20Dateien/_hh/wmfexp.jpg

Using Windows Explorer, irfanview was started, and told me it is a misnamed wmf file, do I want to proceed. I proceeded, and saw some line drawings but not a calculator. But I don't know if that test can work on Win98!

Comment 12

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

(In reply to comment #11)
> the actual test link, when successful, opens windows calculator:
> http://www.heise.de/security/dienste/browsercheck/demos/ie/wmfexp.php
If I understand this bug correctly, the bug is that SeaMonkey launches WMP automatically (without confirmation?) when you click that link.  If so, WFM, I'm prompted to open/save the file.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051229 SeaMonkey/1.5a

Comment 13

[Hermann Schwab]

(In reply to comment #12)
> (In reply to comment #11)
> > the actual test link, when successful, opens windows calculator:
> > http://www.heise.de/security/dienste/browsercheck/demos/ie/wmfexp.php
> I'm prompted to open/save the file.
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051229
> SeaMonkey/1.5a

WFM Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060101 SeaMonkey/1.5a, launches irfanview after asking and getting allowed.

but file:///C:/WINDOWS/SYSTEM/Spbanner.wmf still launches WMP without asking.
Firefox launches that file in irfanview after asking and getting allowed.

Comment 14

[Christian :Biesinger (don't email me, ping me on IRC)]

ah. it does sound like this is the same as bug 322319. marking as dup of that, since that bug has an analysis + patch.

*** This bug has been marked as a duplicate of 322319 ***

Comment 15

[Christian :Biesinger (don't email me, ping me on IRC)]

but just to be sure: You do have the WMP plugin installed, right?

Comment 16

[Hermann Schwab]

(In reply to comment #15)
> but just to be sure: You do have the WMP plugin installed, right?

Yes, I have it installed, an older version, rarely used.

Comment 17

[Christian :Biesinger (don't email me, ping me on IRC)]

if bug 322319 isn't security-sensitive, this doesn't have to be either.

Comment 18

[Hermann Schwab]

WFM with Bug 322319 fixed
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060105 SeaMonkey/1.5a