[NT] Microsoft Help and Support Center Argument Injection Vulnerability
From: SecuriTeam (support_at_securiteam.com)
Date: 04/14/04
- Previous message: SecuriTeam: "[NT] Kerio Personal Firewall Remote DoS (0x13, 0x12)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 14 Apr 2004 09:30:58 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Microsoft Help and Support Center Argument Injection Vulnerability
------------------------------------------------------------------------
SUMMARY
Help and Support Center is a feature of Microsoft Windows that enables
users to download and install software updates, check hardware
compatibility and perform other system related tasks. Exploitation of an
argument injection vulnerability in the Help and Support Center feature of
Microsoft Corp.'s Windows operating system allows remote attackers to
execute arbitrary code.
DETAILS
HCP URIs are handled via the following command as defined in the registry
key HKLM\SOFTWARE\Classes\HCP\shell\open\command:
"C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe" -FromHCP -url "%1"
The %1 is replaced by the argument to the HCP:// URI. By embedding quotes
in the argument, it is possible to insert new arguments to the command.
For example:
HCP://" -url "../../unreachable.htm
When the %1 is substituted in, this gives:
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe -FromHP -url "HCP://"
-url "../../unreachable.htm"
An attacker can compromise a vulnerable system by crafting a URL to inject
scripting code into a pre-existing file such as
System\errors\connection.htm. The scripting code executes under the "My
Computer" zone.
Analysis:
Successful exploitation allows an attacker to remotely execute arbitrary
code under the context of the My Computer zone. Script code executing with
such privileges can be crafted to retrieve and execute arbitrary
third-party code, thereby leading to further compromise.
Detection:
iDEFENSE has confirmed the existence of this vulnerability in the latest
versions of Windows Server 2003 and Windows XP.
Workaround:
As stated in Microsoft advisory MS03-044, the HCP protocol can be
unregistered, thereby preventing successful exploitation. This can be
accomplished by deleting the key 'HKEY_CLASSES_ROOT\HCP' using the windows
registry editor.
Vendor Response:
Microsoft has issued the following update to address this vulnerability:
- Security Update for Microsoft Windows (835732)
CVE Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2003-0907 to this issue. This is a candidate for inclusion in the
CVE list ( <http://cve.mitre.org> http://cve.mitre.org), which
standardizes names for security problems.
Disclosure timeline:
[prior] Exploit disclosed to vendor by contributor
January 12, 2004 - Exploit acquired by iDEFENSE
January 12, 2004 - iDEFENSE clients notified
January 19, 2004 - iDEFENSE Initial contact with vendor
January 23, 2004 - Initial vendor reply
April 13, 2004 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDEFENSE, the vulnerability was
discovered by <http://iki.fi/jouko> Jouko Pynn?nen.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=100&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=100&type=vulnerabilities
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NT] Kerio Personal Firewall Remote DoS (0x13, 0x12)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
