Microsoft PCHealth 2003/XP Buffer Overflow (#NISR15102003)

From: NGSSoftware Insight Security Research (nisr_at_NEXTGENSS.COM)
Date: 10/16/03

  • Next message: Russ: "Re: Patch Solutions - survey"
    Date:         Thu, 16 Oct 2003 12:21:12 +0100

    NGSSoftware Insight Security Research Advisory

    Name: Microsoft PCHealth Buffer Overflow Vulnerability
    Systems Affected: Windows 2003 and XP
    Severity: Critical Risk
    Vendor URL:
    Author: David Litchfield [ ]

    Date Vendor Notified: 23rd July 2003
    Date of Public Advisory: 15th October 2003
    Advisory number: #NISR15102003
    Advisory URL:

    Microsoft Windows 2003 Server and Windows XP provide a support and
    troubleshooting facility called PCHealth. PCHealth provides users
    with information on how to deal with any problems they may
    experience. PCHealth contains search functionality allowing users
    to search using keywords. The Search engine runs as a system service
    and is vulnerable to an exploitable stack based buffer overflow

    The PCHealth system can be launched in several different ways. It can be
    launched via an HTML document rendered in Internet Explorer or Outlook using
    the HCP protocol or via DCOM. This presents remote attackers with several
    vectors to launch an attack; however the latter requires administrative
    privileges already so is not a likely attack vector. It is listed for the
    sake of completeness. Local attackers can, of course, also exploit this
    vulnerability to gain control of the system. The vulnerability is a stack
    based buffer overflow triggered by an overly long query and exists in the
    Help Service (helpsvc.exe) which is started by svchost.exe. As the instance
    of svchost that runs the Help and Support service is also responsible for
    running other services that require SYSTEM privileges it is not possible
    to help mitigate the risk by setting a low privileged account to run
    this service. In the absence of a patch it is suggested that the Help and
    Support service be disabled until the patch can be applied.

    Notes on Windows 2003
    Despite the stack protection built into Windows 2003 (through Visual C++
    .NET) this overflow can still be exploited. (Please read the following paper
    for more details - )

    That said, by default, the security settings of Internet Explorer and
    Outlook Express on Windows 2003 mitigate the risk these systems are exposed
    to via the HTML vector. Local low privileged attackers can still exploit
    this to gain control but best practices dictate that only administrators
    should be allowed to log on to servers. Provided these precautions have been
    followed (or left in place) then the risk posed to Windows 2003 Servers is
    reduced somewhat. That said NGSS advises that the patch still be applied
    once proper testing of the patch has been done.

    Fix Information

    Microsoft have supplied a patch for this problem that can be downloaded

    About NGSSoftware
    NGSSoftware design, research and develop intelligent, advanced application
    security assessment scanners. Based in the United Kingdom, NGSSoftware have
    offices in the South of London and the East Coast of Scotland. NGSSoftware's
    sister company NGSConsulting, offers best of breed security consulting
    services, specialising in application, host and network security

    Telephone +44 208 401 0070
    Fax +44 208 401 0076

    NTBugtraq subscribers save $103.00 off the TICSA exam by using promo
    code "NT1003" when registering to take the TICSA exam at
    Prove to your employer and peers that you have the knowledge and
    abilities to be an active stakeholder in today's enterprise security.
    Become TICSA certified  Promotion expires
    12/31/03 and cannot be used in combination with other offers.

  • Next message: Russ: "Re: Patch Solutions - survey"

    Relevant Pages