[SECURITY-L] [0_47098_AEE7C282-5BFD-4E84-98BC-79A14F27B03B_BR em Newsletters.Microsoft.com: Microsoft Security Bulletin MS03-014: Cumulative Patch for Outlook Express (330994)]

Qui Abr 24 13:36:57 -03 2003

----- Forwarded message from Microsoft <0_47098_AEE7C282-5BFD-4E84-98BC-79A14F27B03B_BR em Newsletters.Microsoft.com> -----

From: "Microsoft" <0_47098_AEE7C282-5BFD-4E84-98BC-79A14F27B03B_BR em Newsletters.Microsoft.com>
Subject: Microsoft Security Bulletin MS03-014: Cumulative Patch for Outlook Express (330994)
To: <mieko em ccuec.unicamp.br>
Date: Thu, 24 Apr 2003 08:38:16 -0700
X-Mailer: Microsoft CDO for Windows 2000

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------
Title:      Cumulative Patch for Outlook Express (330994)
Date:       23 April 2003
Software:   Microsoft (c) Outlook Express
Impact:     Run code of the attacker's choice on a user's machine.
Max Risk:   Critical
Bulletin:   MS03-014

Microsoft encourages customers to review the Security Bulletins at: 
http://www.microsoft.com/technet/security/bulletin/MS03-014.asp
http://www.microsoft.com/security/security_bulletins/ms03-014.asp
- ----------------------------------------------------------------------

Issue:
======
MHTML stands for MIME Encapsulation of Aggregate HTML. MHTML is an 
Internet standard that defines the MIME (Multipurpose Internet Mail 
Extensions) structure used to send HTML content in e-mail message 
bodies. The MHTML URL Handler in Windows is part of Outlook Express 
and provides a URL type that can be used on the local machine. This 
URL type (MHTML://) allows MHTML documents to be launched from a 
command line, from Start/Run, using Windows Explorer or from within 
Internet Explorer.

A vulnerability exists in the MHTML URL Handler that allows any 
file that can be rendered as text to be opened and rendered as part 
of a page in Internet Explorer. As a result, it would be possible 
to construct a URL that referred to a text file that was stored on 
the local computer and have that file render as HTML. If the text 
file contained script, that script would execute when the file was 
accessed. Since the file would reside on the local computer, it 
would be rendered in the Local Computer Security Zone. Files that 
are opened within the Local Computer Zone are subject to fewer 
restrictions than files opened in other security zones. 

Using this method, an attacker could attempt to construct a URL and 
either host it on a website or send it via email. In the web based 
scenario, where a user then clicked on a URL hosted on a website, 
an attacker could have the ability to read or launch files already 
present on the local machine. In the case of an e-mail borne attack, 
if the user was using Outlook Express 6.0 or Outlook 2002 in their 
default configurations, or Outlook 98 or 2000 in conjunction with 
the Outlook Email Security Update, then an attack could not be 
automated and the user would still need to click on a URL sent in 
the e-mail. However if the user was not using Outlook Express 6.0 
or Outlook 2002 in their default configurations, or Outlook 98 or 
2000 in conjunction with the Outlook Email Security Update, the 
attacker could cause an attack to trigger automatically without the 
user having to click on a URL contained in an e-mail. In both the 
web based and e-mail based cases, any limitations on the user's 
privileges would also restrict the capabilities of the attacker's 
script.

Applying the update listed in Microsoft Security Bulletin MS03-004 
- -- Cumulative Patch for Internet Explorer-will help block an 
attacker from being able to load a file onto a user's computer and 
prevent the passing of parameters to an executable. This means that 
an attacker could only launch a program that already existed on the 
computer-provided the attacker was aware of the location of the 
program-and would not be able to pass parameters to the program for 
it to execute.

MHTML is a standard for exchanging HTML content in e-mail and as a 
result the MHTML URL Handler function has been implemented in 
Outlook Express. Internet Explorer can also render MHTML content, 
however the MHTML function has not been implemented separately in 
Internet Explorer - it simply uses Outlook Express to render the 
MHTML content.

Mitigating Factors:
====================
- -For the web-based scenario, the attacker would have to host a web 
site that contained a web page used to exploit this vulnerability 
and entice a user to visit it. An attacker would have no way to 
force a user to visit the site. Instead, the attacker would need to 
lure the user there, typically by getting the user to click on a 
link to the attacker's site. 

- -The HTML mail-based attack scenario would be blocked by Outlook 
Express 6.0 and Outlook 2002 in their default configurations, and 
by Outlook 98 and 2000 if used in conjunction with the Outlook 
Email Security Update. 

- -Exploiting the vulnerability would allow the attacker only the 
same privileges as the user. Users whose accounts are configured to 
have few privileges on the system would be at less risk than ones 
who operate with administrative privileges. 

- -If the cumulative patch for Internet Explorer MS03-004 has been 
installed, known means by which an attacker may place a file onto a 
user's computer will be blocked. 

- -In order to invoke an executable already present on the local 
system, an attacker must know the path to that executable.

Risk Rating:
============
 - Critical

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletins at
   http://www.microsoft.com/technet/security/bulletin/ms03-014.asp
   http://www.microsoft.com/security/security_bulletins/ms03-014.asp

   for information on obtaining this patch.

- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS 
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE 
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, 
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF 
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION 
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES 
SO THE FOREGOING LIMITATION MAY NOT APPLY.

You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification Service.  For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.

To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.

To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at http://register.microsoft.com/regsys/pic.asp 

If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via email as described below:
Reply to this message with the word UNSUBSCRIBE in the Subject line.

For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.

----- End forwarded message -----