Microsoft Windows XP HCP URI Handler Abuse Vulnerability
BID:5478
Info
Microsoft Windows XP HCP URI Handler Abuse Vulnerability
| Bugtraq ID: | 5478 |
| Class: | Design Error |
| CVE: |
CVE-2002-0974 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 15 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Discovery of this issue is credited to "Shane Hird" <[email protected]>. |
| Vulnerable: |
Microsoft Windows XP Professional Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition |
| Not Vulnerable: |
Microsoft Windows XP Professional SP1 Microsoft Windows XP Home SP1 Microsoft Windows XP 64-bit Edition SP1 |
Discussion
Microsoft Windows XP HCP URI Handler Abuse Vulnerability
Microsoft Internet Explorer on Windows XP comes equipped with a protocol handler for the 'Help and Support Center' application. The protocol handler may be specified in links, and when such a link is submitted by the browser, the Help and Control Center will load an appropriate page. However, it has been demonstrated that this behavior may be abused.
The browser runs requests to the HCP URI handler with relaxed Security Zone restrictions. One of the Help and Support Center application files (uplddrvinfo.htm) contains an ActiveX control which may be used to delete local files. Since the ActiveX control accepts filenames from the HCP URIs, it is possible for an attacker to abuse this situation via a malicious link. Because the browser runs the HCP request with relaxed restrictions, the user is not prompted when the ActiveX control is executed. However, it has been reported that a window with a "Get Help With Your Hardware Device" dialog is displayed when uplddrvinfo.htm is invoked, and that the utility will follow through with the commands if the user closes this window.
A number of other files are included in the Help and Support Center application which may also be used by a remote attacker to perform various actions on the client system via a maliciously constructed HCP URI.
Microsoft Internet Explorer on Windows XP comes equipped with a protocol handler for the 'Help and Support Center' application. The protocol handler may be specified in links, and when such a link is submitted by the browser, the Help and Control Center will load an appropriate page. However, it has been demonstrated that this behavior may be abused.
The browser runs requests to the HCP URI handler with relaxed Security Zone restrictions. One of the Help and Support Center application files (uplddrvinfo.htm) contains an ActiveX control which may be used to delete local files. Since the ActiveX control accepts filenames from the HCP URIs, it is possible for an attacker to abuse this situation via a malicious link. Because the browser runs the HCP request with relaxed restrictions, the user is not prompted when the ActiveX control is executed. However, it has been reported that a window with a "Get Help With Your Hardware Device" dialog is displayed when uplddrvinfo.htm is invoked, and that the utility will follow through with the commands if the user closes this window.
A number of other files are included in the Help and Support Center application which may also be used by a remote attacker to perform various actions on the client system via a maliciously constructed HCP URI.
Exploit / POC
Microsoft Windows XP HCP URI Handler Abuse Vulnerability
The following example were submitted:
By using the 'hcp:' protocol, it's possible to launch this from a link. The
filename can also include wild cards. Thus, the following link will delete
all files in the 'C:\windows\' directory when the launched window is closed.
(normal file permissions still apply as usual). Sub-directories are not
deleted.
hcp://system/DFS/uplddrvinfo.htm?file://c:\windows\*
The following example were submitted:
By using the 'hcp:' protocol, it's possible to launch this from a link. The
filename can also include wild cards. Thus, the following link will delete
all files in the 'C:\windows\' directory when the launched window is closed.
(normal file permissions still apply as usual). Sub-directories are not
deleted.
hcp://system/DFS/uplddrvinfo.htm?file://c:\windows\*
Solution / Fix
Microsoft Windows XP HCP URI Handler Abuse Vulnerability
Solution:
The vendor has reported that this issue is addressed in Microsoft Windows XP SP1. For users unable to download the Service Pack, Microsoft has released separate fixes for this issue:
Microsoft Windows XP Home
Microsoft Windows XP Professional
Microsoft Windows XP 64-bit Edition
Solution:
The vendor has reported that this issue is addressed in Microsoft Windows XP SP1. For users unable to download the Service Pack, Microsoft has released separate fixes for this issue:
Microsoft Windows XP Home
-
Microsoft Q328940
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=43681 -
Microsoft Windows XP Service Pack 1
http://www.microsoft.com/WindowsXP/pro/downloads/servicepacks/sp1/defa ult.asp
Microsoft Windows XP Professional
-
Microsoft Q328940
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=43681 -
Microsoft Windows XP Service Pack 1
http://www.microsoft.com/WindowsXP/pro/downloads/servicepacks/sp1/defa ult.asp
Microsoft Windows XP 64-bit Edition
-
Microsoft Q328940
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=43676 -
Microsoft Windows XP Service Pack 1
http://www.microsoft.com/WindowsXP/pro/downloads/servicepacks/sp1/defa ult.asp
References
Microsoft Windows XP HCP URI Handler Abuse Vulnerability
References:
References: