Bofra/IFrame Exploits on More Web Sites. The Storm Center received a report this morning of a high profile UK website that contains a pointer on their main page to another URL hosting the Bofra/IFrame exploit. We have confirmed that if this site is visited using Internet Explorer the exploit will be downloaded. The site owners have been notified.

I know that everybody wants to know "which site?" but to keep little Johnny from burning his fingers we will not list the URL. Please exercise caution when using Microsoft's Internet Explorer since this issue has no current patch. The Storm Center recommends using an alternative browser when visiting sites other than those you absolutely trust.

Thanks to Mark for reporting this to us, and we request that if other sites are found with the Bofra/IFrame exploit on it, let us know. We will attempt to contact the site owners and inform appropriate government response teams if needed.

UPDATE, 1525 UTC. The site in the UK has been fixed. We have received reports of sites in Sweden and the Netherlands that were also compromised. This may indicate a more wide-spread attack across Europe. One suggestion is that the advertising servers rather than the sites themselves contain the exploit, which of course means that perhaps hundreds of sites are affected.
Marcus H. Sachs

Director, SANS Internet Storm Center




UPDATE BELOW at 18:17 UTC - Kyle Haugsness


Microsoft IE IFRAME vulnerability summary (Bofra worm)

Just to refresh everyone on the details. On October 24, a vulnerability
was discovered in the IFRAME tags of Internet Explorer 6.0 affecting
all Windows platforms except Windows XP SP2. This vulnerability can be
exploited by going to a web-site that has malicious code. Currently,
some high profile sites with banner ads are linking to servers that have
the exploit and malicious code.


THERE IS NO PATCH FOR THIS VULNERABILITY! Windows XP SP2 has been
reported as not vulnerable. If you are running IE 6, you are
HIGHLY RECOMMENDED to utilize a different web-browser until a patch is
released by Microsoft. Microsoft has confirmed the vulnerability with
media organizations, but is yet to release any statement on their
website. The next scheduled patch-release day at Microsoft is
24 days away (on December 14).


If you operate a web site that serves banner advertisements, you are
highly recommended to verify that the banners do not contain the IFRAME
exploit code. Or you might want to consider disabling banner ads for
a little while to minimize the risk of accidentally infecting your
users and propogating.


Since this vulnerability is easy to exploit, it is likely that malware
for this issue will come in many flavors and colors. In addition to the
possibility of becoming infected while surfing a website, there are e-mail
propogration vectors. On November 8, we reported MyDoom.AG and MyDoom.AH
(which spread via e-mail) utilize this exploit:


http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=129631

http://vil.nai.com/vil/content/v_129630.htm


Note that some versions of MyDoom that are including the IFRAME exploit
are being called Bofra (variants A - :


http://www.sophos.com/virusinfo/analyses/w32bofraa.html

http://www.sophos.com/virusinfo/analyses/w32bofrah.html


More vulnerability details:

http://secunia.com/advisories/12959/

http://www.kb.cert.org/vuls/id/842160

http://www.securityfocus.com/bid/11515/info/

http://www.k-otik.net/bugtraq/20041102.InternetExplorer.php

http://lists.netsys.com/pipermail/full-disclosure/2004-November/028286.html




UPDATE BELOW at 00:30 UTC - Kyle Haugsness


Two More IE Vulnerabilities

Exploit code has been released for two more Internet Explorer vulnerabilities
that were released on Wednesday (Nov. 17). This code would enable an attacker
to trick users into executing malware. These vulnerabilities affect Microsoft
Internet Explorer 6.0 SP2 and are not prevented by Windows XP SP2.


The original advisory is here:

http://secunia.com/advisories/13203/


The proof of concept exploit:

http://www.k-otik.com/exploits/2041119.IESP2disclosure.php


While on the topic, it is interesting to note some statistics that
Secunia has been compiling about Internet Explorer vulnerabilities:

IE 5.01 - 42 advisories (7 unpatched)   http://secunia.com/product/9/ 

IE 5.5  - 55 advisories (8 unpatched)   http://secunia.com/product/10/ 

IE 6.0  - 69 advisories (18 unpatched)  http://secunia.com/product/11/