Microsoft Security Bulletin MS03-006: Flaw in Windows Me Help and Support Center Could Enable Code Execution (812709)

2003-02-27T00:00:00
ID SECURITYVULNS:DOC:4139
Type securityvulns
Reporter Securityvulns
Modified 2003-02-27T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE-----


Title: Flaw in Windows Me Help and Support Center Could Enable Code Execution (812709) Date: 26 February, 2003 Software: Microsoft Windows Me Impact: Run Code of Attacker's Choice Max Risk: Critical Bulletin: MS03-006

Microsoft encourages customers to review the Security Bulletins at: http://www.microsoft.com/technet/security/bulletin/MS03-006.asp http://www.microsoft.com/security/security_bulletins/ms03-006.asp


Issue:

Help and Support Center provides a centralized facility through which users can obtain assistance on a variety of topics. For instance, it provides product documentation, assistance in determining hardware compatibility, access to Windows Update, online help from Microsoft, and other assistance. Users and programs can execute URL links to Help and Support Center by using the "hcp://" prefix in a URL link instead of "http://".

A security vulnerability is present in the Windows Me version of Help and Support Center, and results because the URL Handler for the "hcp://" prefix contains an unchecked buffer.

An attacker could exploit the vulnerability by constructing a URL that,when clicked on by the user, would execute code of the attacker's choice in the Local Computer security context. The URL could be hosted on a web page, or sent directly to the user in email. In the web based scenario, where a user then clicked on the URL hosted on a website, an attacker could have the ability to read or launch files already present on the local machine. In the case of an e-mail borne attack, if the user was using Outlook Express 6.0 or Outlook 2002 in their default configurations, or Outlook 98 or 2000 in conjunction with the Outlook Email Security Update, then an attack could not be automated and the user would still need to click on a URL sent in e-mail. However if the user was not using Outlook Express 6.0 or Outlook 2002 in their default configurations, or Outlook 98 or 2000 in conjunction with the Outlook Email Security Update, the attacker could cause an attack to trigger automatically without the user having to click on a URL contained in an e-mail.

Mitigating Factors:

  • The Help and Support Center function could not be started automatically in Outlook Express or Outlook if the user is running Internet Explorer 6.0 Service Pack 1.
  • For an attack to be successful, the user would need to visit a website under the attacker's control or receive an HTML e-mail from the attacker.
  • Automatic exploitation of the vulnerability by an HTML email would be blocked by Outlook Express 6.0 and Outlook 2002 in their default configurations, and by Outlook 98 and 2000 if used in conjunction with the Outlook Email Security Update.

Risk Rating:

  • Critical

Patch Availability:

  • A patch is available to fix this vulnerability. Please read the Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-006.asp http://www.microsoft.com/security/security_bulletins/ms03-006.asp

for information on obtaining this patch.


THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

-----BEGIN PGP SIGNATURE----- Version: PGP 7.1

iQEVAwUBPl0MJo0ZSRQxA/UrAQGXswgAg+ZZ1oCiFD6ktITFi7Q3Oc44txdU927I MRwZq6y6HHAD+hjcAbDyT5X9Djc36tYEB5CaDbq/qCWgSUJa6qopf11PCuxd9XS7 7XoI73ofAoVSnRB9x9wknRAoTRtffNwmyW8ILuVVCK3y0JP+ThgYS6DinY9OCY5Q Fa7X4aojh5kwV5nQt4cyPKk7C9arVLJ0ww6c66J8XdF+/p7kILItrSqsqUDe1gz1 ES4ib7MnAnGPNlB/elSRuDYU4YkgBEEVgC5od28VcaBAq+GHn4KEYWDkpRNQozQj azo+D8/Y+v3zdFau9oTrqV6MgKR2yULCeKQidcOrU2QLxmWW5cw/bA== =jA6C -----END PGP SIGNATURE-----


You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification Service. For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.

To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.

To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at http://register.microsoft.com/regsys/pic.asp

If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via email as described below: Reply to this message with the word UNSUBSCRIBE in the Subject line.

For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.