Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability

Bugtraq ID:	10321
Class:	Input Validation Error
CVE:	CVE-2004-0199
Remote:	Yes
Local:	No
Published:	May 11 2004 12:00AM
Updated:	Jul 12 2009 04:07AM
Credit:	Discovery is credited to Donnie Werner.
Vulnerable:	Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition
Not Vulnerable:

Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability

A security vulnerability has been reported in Microsoft Windows XP and Server 2003 operating systems. This issue exists in the Help and Support Center (HSC) and is due to how the feature handles HCP invocation URIs for DVD driver upgrades.

This issue could be exploited from a malicious web page or HTML e-mail to cause a malicious executable to be run on a vulnerable system. This would occur in the context of the victim user, though it has been reported that significant user interaction is required for exploitation to occur.

While this issue may be exploited through Internet Explorer, it should also be noted that third-party web client software could also invoke HSC via a HCP URI.

Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability

There is no exploit required, though it is believed that a victim would have to perform a number of actions manually for exploitation to be successful.

A proof-of-concept is provided at the following location:
http://www.exploitlabs.com/files/advisories/EXPL-A-2003-027-helpctr.txt

Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability

Solution:
Microsoft has released fixes to address this issue.


Microsoft Windows Server 2003 Web Edition

• Microsoft Security Update for Windows Server 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=50AD42D7-81BD -4F96-9AD1-0E67310551DF&displaylang=en

Microsoft Windows Server 2003 Standard Edition

• Microsoft Security Update for Windows Server 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=50AD42D7-81BD -4F96-9AD1-0E67310551DF&displaylang=en

Microsoft Windows XP Home

• Microsoft Security Update for Windows XP (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=563F65A3-D793 -47B4-A607-948CAA5B3454&displaylang=en

Microsoft Windows XP 64-bit Edition Version 2003

• Microsoft Security Update for Microsoft Windows Server 2003 and Windows XP 64 Bit Edition Vers 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E05DE6AB-FB0D -4A0E-B34E-BB69B9D6BA74&displaylang=en


• Microsoft Security Update for Windows XP 64 Bit Edition (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6 -45FA-B87C-E29135199DC9&displaylang=en


• Microsoft Security Update for Windows XP 64 Bit Edition 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6 -45FA-B87C-E29135199DC9&displaylang=en

Microsoft Windows XP 64-bit Edition

• Microsoft Security Update for Windows XP 64 Bit Edition (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6 -45FA-B87C-E29135199DC9&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft Security Update for Windows XP (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=563F65A3-D793 -47B4-A607-948CAA5B3454&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition

• Microsoft Security Update for Windows Server 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=50AD42D7-81BD -4F96-9AD1-0E67310551DF&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Microsoft Security Update for Microsoft Windows Server 2003 and Windows XP 64 Bit Edition Vers 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E05DE6AB-FB0D -4A0E-B34E-BB69B9D6BA74&displaylang=en

Microsoft Windows XP Professional

• Microsoft Security Update for Windows XP (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=563F65A3-D793 -47B4-A607-948CAA5B3454&displaylang=en

Microsoft Windows XP 64-bit Edition Version 2003 SP1

• Microsoft Security Update for Microsoft Windows Server 2003 and Windows XP 64 Bit Edition Vers 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E05DE6AB-FB0D -4A0E-B34E-BB69B9D6BA74&displaylang=en


• Microsoft Security Update for Windows XP 64 Bit Edition (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6 -45FA-B87C-E29135199DC9&displaylang=en


• Microsoft Security Update for Windows XP 64 Bit Edition 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6 -45FA-B87C-E29135199DC9&displaylang=en

Microsoft Windows XP Professional SP1

• Microsoft Security Update for Windows XP (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=563F65A3-D793 -47B4-A607-948CAA5B3454&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition

• Microsoft Security Update for Windows Server 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=50AD42D7-81BD -4F96-9AD1-0E67310551DF&displaylang=en

Microsoft Windows XP 64-bit Edition SP1

• Microsoft Security Update for Windows XP 64 Bit Edition (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6 -45FA-B87C-E29135199DC9&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Microsoft Windows Server 2003 and Windows XP 64 Bit Edition Vers 2003 (KB840374)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E05DE6AB-FB0D -4A0E-B34E-BB69B9D6BA74&displaylang=en

Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability

References:

• EXPL-A-2003-027 exploitlabs.com Advisory 027 (Exploit Labs)
  
• Microsoft Security Bulletin MS04-015 (Microsoft)