[SECURITY-L] CAIS-Alerta: Vulnerabilidade no Windows Help (840374)

Qua Maio 12 10:40:52 -03 2004

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Vulnerabilidade no Windows Help (840374)
To: rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Tue, 11 May 2004 17:43:32 -0300 (BRST)

-----BEGIN PGP SIGNED MESSAGE-----

Prezados,

O CAIS esta' repassando o alerta divulgado pela Microsoft, "Microsoft
Security Bulletin MS04-015: Vulnerability in Help and Support Center Could
Allow Remote Code Execution (840374)", que trata da identificacao de uma
vulnerabilidade no Windows Help e Support Center que pode permitir a um
atacante remoto a execucao de codigo arbitrario.

Um atacante poderia explorar a vulnerabilidade criando uma URL HCP
(hcp://...) que permitiria a execucao de codigo arbitrario caso um usuario
visitasse um web site ou visualizasse um e-mail malicioso. Um atacante
poderia, por meio desta vulnerabilidade, ter total controle sob um sistema
afetado embora seja necessaria a interacao do usuario para que isto
aconteca.

Sistemas Afetados:

. Microsoft Windows XP and Microsoft Windows XP Service Pack 1
. Microsoft Windows XP 64-Bit Edition Service Pack 1
. Microsoft Windows XP 64-Bit Edition Version 2003
. Microsoft Windows Server 2003
. Microsoft Windows Server 2003 64-Bit Edition

Sistemas *nao* Afetados:

. Microsoft Windows NT® Workstation 4.0 Service Pack 6a
. Microsoft Windows NT Server 4.0 Service Pack 6a
. Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6
. Microsoft Windows 2000 Service Pack 2
. Microsoft Windows 2000 Service Pack 3
. Microsoft Windows 2000 Service Pack 4
. Microsoft Windows 98
. Microsoft Windows 98 Second Edition (SE)
. Microsoft Windows Millennium Edition (ME)

Correções disponíveis:

A correção consiste na aplicação do patch recomendado pela Microsoft e
disponível em:

. Microsoft Windows XP and Microsoft Windows XP Service Pack 1
http://www.microsoft.com/downloads/details.aspx?FamilyId=563F65A3-D793-47B4-A607-948CAA5B3454&displaylang=en

. Microsoft Windows XP 64-Bit Edition Service Pack 1
http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6-45FA-B87C-E29135199DC9&displaylang=en

. Microsoft Windows XP 64-Bit Edition Version 2003
http://www.microsoft.com/downloads/details.aspx?FamilyId=EB954F03-EFC6-45FA-B87C-E29135199DC9&displaylang=en

. Microsoft Windows Server 2003
http://www.microsoft.com/downloads/details.aspx?FamilyId=50AD42D7-81BD-4F96-9AD1-0E67310551DF&displaylang=en

. Microsoft Windows Server 2003 64-Bit Edition
http://www.microsoft.com/downloads/details.aspx?FamilyId=E05DE6AB-FB0D-4A0E-B34E-BB69B9D6BA74&displaylang=en

Mais informações:

. Microsoft Security Bulletin MS04-015
Vulnerability in Help and Support Center Could Allow Remote Code Execution (840374)
http://www.microsoft.com/technet/security/bulletin/MS04-015.mspx

. Microsoft Brasil - Security
http://www.microsoft.com/brasil/security

. Technet Brasil - Central de Seguranca
http://www.technetbrasil.com.br/seguranca

Identificadores do CVE: CAN-2004-0199, (http://cve.mitre.org)

O CAIS recomenda aos administradores de plataformas Microsoft que
mantenham seus sistemas e aplicativos sempre atualizados.

Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

Microsoft Security Bulletin MS04-015
Vulnerability in Help and Support Center Could Allow Remote Code Execution
(840374)

Issued: May 11, 2004
Updated: May 11, 2004
Version: 1.1
Summary

Who should read this document: Customers who use Microsoft® Windows®

Impact of Vulnerability:  Remote Code Execution

Maximum Severity Rating: Important

Recommendation: Customers should install the update at the earliest
opportunity.

Security Update Replacement: None

Caveats: Microsoft Knowledge Base Article 841996 documents a known issue
that customers may experience when they install this security update on a
system where the Help and Support Center service is disabled. For the
installation of this security update to be successful, the Help and
Support Center service cannot be disabled. The article also documents
recommended solutions for this issue. For more information, see Microsoft
Knowledge Base Article 841996.

Tested Software and Security Update Download Locations:

Affected Software:

Microsoft Windows XP and Microsoft Windows XP Service Pack 1 ? Download
the update

Microsoft Windows XP 64-Bit Edition Service Pack 1 ? Download the update

Microsoft Windows XP 64-Bit Edition Version 2003 ? Download the update

Microsoft Windows Server? 2003 ? Download the update

Microsoft Windows Server 2003 64-Bit Edition ? Download the update

Non-Affected Software:

Microsoft Windows NT® Workstation 4.0 Service Pack 6a

Microsoft Windows NT Server 4.0 Service Pack 6a

Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6

Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack
3, Microsoft Windows 2000 Service Pack 4

Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and
Microsoft Windows Millennium Edition (ME)

The software in this list has been tested to determine if the versions are
affected. Other versions either no longer include security update support
or may not be affected. To determine the support lifecycle for your
product and version, visit the following Microsoft Support Lifecycle Web
site.