Microsoft Windows Help And Support Center URI Validation Code Execution Vulnerability

Bugtraq ID:	10119
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 13 2004 12:00AM
Updated:	Apr 13 2004 12:00AM
Credit:	Discovery is credited to Jouko Pynnönen.
Vulnerable:	Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows ME Avaya S8100 Media Servers 0 + Microsoft Windows 2000 Server + Microsoft Windows NT Server 4.0 SP6a Avaya S3400 Message Application Server 0 + Microsoft Windows 2000 Server Avaya IP600 Media Servers Avaya DefinityOne Media Servers
Not Vulnerable:

Microsoft Windows Help And Support Center URI Validation Code Execution Vulnerability

Microsoft has reported a vulnerability in the Help and Support Center that is related to how HCP URIs are validated. This issue could reportedly be exploited via a malicious web page or HTML e-mail to execute arbitrary code on a client system.

The issue may permit an attacker to inject invocation arguments when HCP URIs cause the HelpCtr.exe component to be executed. By placing malicious content into a known location on the system, whose contents the attacker may influence via a malicious web page, it is possible to exploit this issue to cause the malicious content to be executed in the Local Zone.

It should be noted that the vulnerable functionality is included in Microsoft Windows ME but that the vendor has not considered this vulnerability to pose a serious threat to users of this operating system. The vendor has not qualified why the threat is reduced for Windows ME users.

Microsoft Windows Help And Support Center URI Validation Code Execution Vulnerability

There is no exploit required.

Microsoft Windows Help And Support Center URI Validation Code Execution Vulnerability

Solution:
Avaya has released an advisory to announce that Avaya System Products shipping on Microsoft platforms are also affected by this vulnerability. Avaya advise that customers follow the Microsoft recommendations for the resolution of this issue. The aforementioned advisory can be viewed at the following location:
http://support.avaya.com/japple/css/japple?temp.groupID=&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=161384&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()

Microsoft has released fixes to address this issue.

US-CERT has released an advisory TA04-104A to address this and other issues. Please see the referenced advisory for more information.


Microsoft Windows Server 2003 Web Edition

• Microsoft Security Update for Windows Server 2003 (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EAB176D0-01CF -453E-AE7E-7495864E8D8C&displaylang=en

Microsoft Windows XP Home

• Microsoft Security Update for Windows XP (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F -43B9-A4F1-AF243B6168F3&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft Security Update for Windows XP (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F -43B9-A4F1-AF243B6168F3&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 64 Bit Edition and Windows XP 64 Bit Edition Version 2003 (
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C207D372-E883 -44A6-A107-6CD2D29FC6F5&displaylang=en

Microsoft Windows XP 64-bit Edition Version 2003 SP1

• Microsoft Security Update for Windows Server 2003 64 Bit Edition and Windows XP 64 Bit Edition Version 2003 (
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C207D372-E883 -44A6-A107-6CD2D29FC6F5&displaylang=en

Microsoft Windows XP 64-bit Edition SP1

• Microsoft Security Update for Windows XP 64 Bit Edition (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C6B55EF2-D9FE -4DBE-AB7D-73A20C82FF73&displaylang=en

Microsoft Windows Server 2003 Standard Edition

• Microsoft Security Update for Windows Server 2003 (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EAB176D0-01CF -453E-AE7E-7495864E8D8C&displaylang=en

Microsoft Windows XP 64-bit Edition Version 2003

• Microsoft Security Update for Windows Server 2003 64 Bit Edition and Windows XP 64 Bit Edition Version 2003 (
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C207D372-E883 -44A6-A107-6CD2D29FC6F5&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition

• Microsoft Security Update for Windows Server 2003 (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EAB176D0-01CF -453E-AE7E-7495864E8D8C&displaylang=en

Microsoft Windows XP Professional

• Microsoft Security Update for Windows XP (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F -43B9-A4F1-AF243B6168F3&displaylang=en

Microsoft Windows XP Professional SP1

• Microsoft Security Update for Windows XP (KB835732)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F -43B9-A4F1-AF243B6168F3&displaylang=en

Microsoft Windows Help And Support Center URI Validation Code Execution Vulnerability

References:

• Microsoft Help and Support Center Argument Injection Vulnerability (iDEFENSE)
  
• Microsoft Security Bulletin MS04-011 (Microsoft)
  
• Microsoft Help and Support Center argument injection vulnerability (Jouko Pynnonen )