[SECURITY-L] CAIS-Alerta: Vulnerabilidade no Help do Windows Me (812709)

[Silvana Mieko Misuta]

Subject: CAIS-Alerta: Vulnerabilidade no Help do Windows Me (812709)
    Date: Thu, 27 Feb 2003 14:50:19 -0300 (BRT)
   From: Centro de Atendimento a Incidentes de Seguranca
<cais em cais.rnp.br>
       To: rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br

-----BEGIN PGP SIGNED MESSAGE-----


Prezados,

O CAIS está repassando o alerta divulgado pela Microsoft, Microsoft
Security Bulletin MS03-006: Flaw in Windows Me Help and Support Center
Could Enable Code Execution (812709), que trata de uma vulnerabilidade
existente na implementacao do Help e do Support Center do Windows Me que

pode permitir a um atacante remoto a execucao de codigo arbitrario.


Sistemas Afetados:

        . Microsoft Windows Me


Correções disponíveis:

A correção consiste na aplicação do patch recomendado pela Microsoft e
disponível na URL listada abaixo.

. Windows Me

http://windowsupdate.microsoft.com


Maiores informações:

http://www.microsoft.com/technet/security/bulletin/ms03-006.asp


Identificador do CVE:  CAN-2003-0009 (http://cve.mitre.org)


O CAIS recomenda aos administradores de plataformas Microsoft que
mantenham seus sistemas e aplicativos sempre atualizados.


Atenciosamente,


################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA / RNP      #
#                                                              #
# cais em cais.rnp.br     http://www.cais.rnp.br                  #
# Tel. 019-37873300    Fax. 019-37873301                       #
# Chave PGP disponivel em: http://www.cais.rnp.br/cais-pgp.key #
################################################################

- ----------------------------------------------------------------
Title:      Flaw in Windows Me Help and Support Center Could
            Enable Code Execution (812709)
Date:       26 February, 2003
Software:   Microsoft Windows Me
Impact:     Run Code of Attacker's Choice
Max Risk:   Critical
Bulletin:   MS03-006

Microsoft encourages customers to review the Security Bulletins
at:
http://www.microsoft.com/technet/security/bulletin/MS03-006.asp
http://www.microsoft.com/security/security_bulletins/ms03-006.asp
- -----------------------------------------------------------------

Issue:
======
Help and Support Center provides a centralized facility through
which users can obtain assistance on a variety of topics. For
instance, it provides product documentation, assistance in
determining hardware compatibility, access to Windows Update,
online help from Microsoft, and other assistance. Users and
programs can execute URL links to Help and Support Center by
using the "hcp://" prefix in a URL link instead of "http://".

A security vulnerability is present in the Windows Me version of
Help and Support Center, and results because the URL Handler for
the "hcp://" prefix contains an unchecked buffer.

An attacker could exploit the vulnerability by constructing a URL
that,when clicked on by the user, would execute code of the
attacker's choice in the Local Computer security context. The URL
could be hosted on a web page, or sent directly to the user in
email. In the web based scenario, where a user then clicked on
the URL hosted on a website, an attacker could have the ability
to read or launch files already present on the local machine. In
the case of an e-mail borne attack, if the user was using Outlook
Express 6.0 or Outlook 2002 in their default configurations, or
Outlook 98 or 2000 in conjunction with the Outlook Email Security
Update, then an attack could not be automated and the user would
still need to click on a URL sent in e-mail. However if the user
was not using Outlook Express 6.0 or Outlook 2002 in their
default configurations, or Outlook 98 or 2000 in conjunction with
the Outlook Email Security Update, the attacker could cause an
attack to trigger automatically without the user having to click
on a URL contained in an e-mail.

Mitigating Factors:
====================
 - The Help and Support Center function could not be started
automatically in Outlook Express or Outlook if the user is
running Internet Explorer 6.0 Service Pack 1.
 - For an attack to be successful, the user would need to visit a
website under the attacker's control or receive an HTML e-mail
from the attacker.
 - Automatic exploitation of the vulnerability by an HTML email
would be blocked by Outlook Express 6.0 and Outlook 2002 in their
default configurations, and by Outlook 98 and 2000 if used in
conjunction with the Outlook Email Security Update.

Risk Rating:
============
 - Critical

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read
the Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-006.asp
http://www.microsoft.com/security/security_bulletins/ms03-006.asp

for information on obtaining this patch.


- -----------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT
DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING
THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL, CONSEQUENTIAL,LOSS OF BUSINESS PROFITS OR SPECIAL
DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT
ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.


*******************************************************************


-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQCVAwUBPl5P4+kli63F4U8VAQG8ygQAjcFMIqLAn9/iSvLsJEwtP7CS0UYT+i3Y
eULGBmzDlpySofBIkjWCbmJCtOw3R74kiitlS6HBwIlnriaESQ63UJUmpdWNLXkv
t8xSL/g5AhEvuyr5tgc4ZcjEqAr1PJ9dJ7WrGbL8DK8UGbvaJhBPn+z5dldDH/dX
wvqcraigP1c=
=gjgO
-----END PGP SIGNATURE-----