Internet Explorer VBScript Windows Help arbitrary code execution

Overview

Microsoft Internet Explorer is vulnerable to arbitrary code execution through the use of VBScript and Windows Help.

Description

Microsoft Internet Explorer supports the use of VBScript, in addition to the more widely-used JavaScript scripting language. Several VBScript commands allow a “HelpFile” parameter to be specified, such as the MsgBox function. This parameter may point to a file on the local filesystem, or it may refer to a file that is hosted remotely via Windows file sharing. When the F1 key is pressed, Internet Explorer will launch Windows Help (winhlp32.exe) to display the specified context-sensitive help file. Because Windows Help .HLP files are unsafe files, this behavior can result in arbitrary code execution.

Exploit code for this vulnerability is publicly available.

---

Impact

By convincing a victim to view an HTML document (web page, HTML email, or email attachment) with Internet Explorer and to press the F1 key, an attacker could run arbitrary code with the privileges of the user running the application.

---

Solution

Apply an update
This issue is addressed in Microsoft Security Bulletin MS10-022.

---

Block outbound SMB traffic

This and other vulnerabilities may be mitigated by blocking outbound SMB traffic from your network to the internet. This can limit the ability to link to a remotely-hosted .HLP file using VBScript.

Do not press F1 while using Internet Explorer

The exploit code for this vulnerability requires the user to press F1 to trigger the context-sensitive help. If F1 is not pressed, then the code is not executed.

---

Vendor Information

612021

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: April 28, 2010

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

This issue is addressed in Microsoft Security Bulletin MS10-022.

Vendor References

• <http://www.microsoft.com/technet/security/advisory/981169.mspx&gt;
• <http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx&gt;

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/MS10-022.mspx&gt;
• <http://www.microsoft.com/technet/security/advisory/981169.mspx&gt;
• <http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx&gt;
• <http://isec.pl/vulnerabilities10.html&gt;
• <http://msdn.microsoft.com/en-us/library/sfw6660x(VS.85).aspx&gt;
• <http://support.microsoft.com/kb/291369&gt;

Acknowledgements

This vulnerability was publicly disclosed by iSEC SEcurity Research.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2010-0483
Severity Metric:	6.08 Date Public: