BID:11467

Microsoft Windows HTML Help Control Cross-Zone Scripting Vulnerability

Info

Microsoft Windows HTML Help Control Cross-Zone Scripting Vulnerability

Bugtraq ID:	11467
Class:	Access Validation Error
CVE:	CVE-2004-1043
Remote:	Yes
Local:	No
Published:	Oct 20 2004 12:00AM
Updated:	Jul 12 2009 08:06AM
Credit:	Discovery is credited to http-equiv.
Vulnerable:	Nortel Networks Symposium Web Client Nortel Networks Symposium Web Center Portal (SWCP) Nortel Networks SL100 Corporate Directory Nortel Networks Periphonics Nortel Networks Optivity Telephony Manager for SL-100 Nortel Networks Optivity Telephony Manager (OTM) Nortel Networks Optivity Switch Manager (OSM) Nortel Networks Optivity Network Management System Nortel Networks Optivity Network Configuration System (NCS) Nortel Networks Optivity NetID Nortel Networks Network Configuration Manager for BCM Nortel Networks Mobile Voice Client 2050 Nortel Networks Meridian SL-100 Nortel Networks MCS 5200 3.0 Nortel Networks MCS 5100 3.0 Nortel Networks IP softphone 2050 Nortel Networks CPL (Craft Photonic Layer) Web client (IE) Nortel Networks Contivity VPN Client 5.0 1_030 Nortel Networks Contivity VPN Client 4.91 Nortel Networks Contivity VPN Client 4.86 Nortel Networks Contivity VPN Client 4.15 Nortel Networks Contivity Configuration Manager Nortel Networks CallPilot 703t Nortel Networks CallPilot 201i Nortel Networks CallPilot 1002rp Nortel Networks Call Center Management Information System (CCMIS) Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition SP1 Beta 1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition SP1 Beta 1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Microsoft Internet Explorer 6.0 SP2 - do not use

Not Vulnerable:

Discussion

Microsoft Windows HTML Help Control Cross-Zone Scripting Vulnerability

The Microsoft Windows HTML Help ActiveX control (hhctrl.ocx) is prone to a vulnerability that may permit cross-zone scripting. The HTML Help control is a component that allows help functionality to be inserted in an HTML file. It is possible to exploit this vulnerability through Internet Explorer or other applications that use the same HTML rendering engine.

Specifically, it is possible to coerce Internet Explorer to open remote HTML Help content within the Windows Help system.

It has been previously reported that this issue required a second issue (namely BID 11466) to place malicious code onto the affected computer. However this has recently been shown to be untrue; this issue alone may be used to execute code in other Security Zones such as the Local Zone. An attacker could also exploit this issue in a cross-domain scripting attack that allows script code to access the properties of a window in a foreign domain.

The original proof-of-concept that uses the issue outlined in BID 11466, as well as the later proof of concepts employ various ADODB methods such as ADODB.Connection and ADODB.recordset to write malicious arbitrary code to the file system, in the form of an '.HTA' type file.

Update: A new variant of this attack is available that could allow for execution of arbitrary script code in other domains and other zones.

Exploit / POC

Microsoft Windows HTML Help Control Cross-Zone Scripting Vulnerability

A reliable exploit (injecthh_op_2-code_by_liudieyu.zip) has been made available by Liu Die Yu <[email protected]>; the payload.exe file has been removed from this archive. Further details can be found in the associated discussion reference.

An exploit has been published on the following Web page:

http://www.malware.com/noceegar.html

An additional proof of concept (files.zip) has been made available by Michael Evanchik <[email protected]>, instructions on how to configure this proof of concept can be found in the associated message reference:

Additional proof of concept allows for the execution of arbitrary script code in other domains:

http://www.persiax.com/pocs/htmlhelp/cs.htm

http://www.persiax.com/pocs/htmlhelp/cz.htm

The following proof of concept provided by Paul <[email protected]>, allows for local zone security bypass and eliminates user interaction:

&lt;OBJECT id="hhctrl" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"codebase="hhctrl.ocx#Version=5,2,3790,1194"width=7% height=7%
style="position:absolute;top:140;left:72;z-index:100;">
<PARAM name="Command" value="Related Topics, MENU">
<PARAM name="Button" value="Text:Just a button">
<PARAM name="Window" value="$global_blank">
<PARAM name="Item1" value="command;C:\WINDOWS\PCHealth\malwarez[1].htm">
&lt;/OBJECT&gt;
&lt;script&gt;
hhctrl.HHClick();
&lt;/script&gt;

Another proof of concept exploit has been made available by Greyhats that leverages this issue. The exploit can be found here. Please note that this exploit has not been verified by Symantec.

http://freehost07.websamba.com/greyhats/sp2rc.htm

A new proof of concept has been made available that allows applications to be executed with parameters:

http://www.freewebs.com/shreddersub7/htm.htm

This exploit has not been tested or verified by Symantec and is currently under analysis. This record will be updated if new information becomes available.

Further exploit code:

/data/vulnerabilities/exploits/files.zip
/data/vulnerabilities/exploits/injecthh_op_2-code_by_liudieyu.zip

Solution / Fix

Microsoft Windows HTML Help Control Cross-Zone Scripting Vulnerability

Solution:
Microsoft has released updates for supported platforms.

Fixes are also available for Microsoft Windows 98/98SE/ME may be obtained through Windows Update.

US-CERT has made an advisory available. Please see the reference for more information.

Nortel Networks has released security advisory 2005005435-1 addressing this issue. Please see the referenced advisory for further information.

Microsoft Windows XP Tablet PC Edition SP1