MinorRev: Microsoft Security Bulletin MS04-015 - Vulnerability in Help and Support Center Could Allow Remote Code Execution (840374)

From: Russ Cooper (Russ.Cooper_at_TRUSECURE.CA)
Date: 06/15/04

  • Next message: Russ Cooper: "Alert: Microsoft Security Bulletin MS04-016 - Vulnerability in DirectPlay Could Allow Denial of Service (839643)" 
    Date:         Tue, 15 Jun 2004 17:36:05 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Microsoft Security Bulletin MS04-015:
    Vulnerability in Help and Support Center Could Allow Remote Code
    Execution (840374)

    Bulletin URL:
    <http://www.microsoft.com/technet/security/bulletin/MS04-015.mspx>

    Reason for Revision: Bulletin updated to reflect updated information in
    the Executive Summary and FAQ Section.
    Version Number: 1.1
    Issued Date: Tuesday, May 11, 2004
    Revision Date: Tuesday, May 11, 2004
    Impact of Vulnerability: Remote Code Execution
    Maximum Severity Rating: Important
    Patch(es) Replaced: None
    Caveats: Microsoft Knowledge Base Article 841996 documents a known issue
    that customers may experience when they install this security update on
    a system where the Help and Support Center service is disabled. For the
    installation of this security update to be successful, the Help and
    Support Center service cannot be disabled. The article also documents
    recommended solutions for this issue. For more information, see
    Microsoft Knowledge Base Article 841996.

    Executive Summary:
    ------------------
    This update resolves a newly-discovered vulnerability. A remote code
    execution vulnerability exists in the Help and Support Center because of
    the way that it handles HCP URL validation. The vulnerability is
    documented in the Vulnerability Details section of this bulletin.

    If a user is logged on with administrative privileges, an attacker who
    successfully exploited this vulnerability could take complete control of
    an affected system, including installing programs; viewing, changing, or
    deleting data; or creating new accounts with full privileges. Users
    whose accounts are configured to have fewer privileges on the system
    would be at less risk than users who operate with administrative
    privileges.

    Tested Software:
    Affected Software:
    ------------------
    * Microsoft Windows XP and Microsoft Windows XP Service Pack 1
    <http://tinyurl.com/2wvko>
    * Microsoft Windows XP 64-Bit Edition Service Pack 1
    <http://tinyurl.com/2vso6>
    * Microsoft Windows XP 64-Bit Edition Version 2003
    <http://tinyurl.com/2vso6>
    * Microsoft Windows Server(tm) 2003
    <http://tinyurl.com/2rg2u>
    * Microsoft Windows Server 2003 64-Bit Edition
    <http://tinyurl.com/2h99m>

    Technical Description:
    ----------------------
    * Help and Support Center Vulnerability - CAN-2004-0199: A remote code
    execution vulnerability exists in the Help and Support Center because of
    the way that it handles HCP URL validation. An attacker could exploit
    the vulnerability by constructing a malicious HCP URL that could
    potentially allow remote code execution if a user visited a malicious
    Web site or viewed a malicious e-mail message. An attacker who
    successfully exploited this vulnerability could take complete control of
    an affected system. However, significant user interaction is required to
    exploit this vulnerability.

    Revision History:
    -----------------
    * v1.0 - 5/11/2004: Bulletin published
    * v1.1 - 5/11/2004: Bulletin updated to reflect updated information in
    the Executive Summary and FAQ Section.

    This email is sent to NTBugtraq automagically as a service to my
    subscribers. (v4.01.1625.28734)

    Cheers,
    Russ - Senior Scientist - TruSecure Corporation/NTBugtraq Editor

    -----
    NTBugtraq Editor's Note:

    Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you''ll have to copy their email address out of the message and place it in your TO: field.
    -----

  • Next message: Russ Cooper: "Alert: Microsoft Security Bulletin MS04-016 - Vulnerability in DirectPlay Could Allow Denial of Service (839643)"

    Relevant Pages

    • SecurityFocus Microsoft Newsletter #274
      ... MICROSOFT VULNERABILITY SUMMARY ... NetSarang XLPD Remote Denial of Service Vulnerability ... Microsoft Excel Unspecified Code Execution Vulnerability ... Microsoft Outlook / Microsoft Exchange TNEF Decoding Remote Code ...
      (Focus-Microsoft)
    • Alert: Microsoft Security Bulletin MS04-015 - Vulnerability in Help and Support Center Could Allow R
      ... Microsoft Security Bulletin MS04-015: ... Vulnerability in Help and Support Center Could Allow Remote Code ... Impact of Vulnerability: Remote Code Execution ...
      (NT-Bugtraq)
    • Re: KB943460 and Windows XP SP2 MUI
      ... this is a Critical Security update issued because there is an active exploit of the vulnerability discussed here: ... Microsoft Security Bulletin MS07-061 – ... It's a NO-CHARGE support case. ...
      (microsoft.public.windowsupdate)
    • SecurityFocus Microsoft Newsletter #176
      ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft Windows XP HCP URI Handler Arbitrary Command Execu... ... PHPNuke Category Parameter SQL Injection Vulnerability ... Microsoft Baseline Security Analyzer Vulnerability Identific... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #83
      ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft IIS CodeBrws.ASP Source Code Disclosure Vulnerability ... Microsoft Internet Explorer History List Script Injection ... Microsoft Windows 2000 Lanman Denial of Service Vulnerability ...
      (Focus-Microsoft)