MS03-006: Security Vulnerability in Windows Millennium Edition Help and Support Center May Permit Malicious Code to Run (812709)

SYMPTOMS

Help and Support Center provides a centralized facility that users can obtain assistance from about a variety of topics. For example, it provides product documentation, help in determining hardware compatibility, access to Windows Updates, online Help from Microsoft, and other resources. Users and programs can execute URL links to Help and Support Center by using the "hcp://" prefix in a URL link instead of "http://".

However, there is a security vulnerability in the Windows Millennium Edition (Me) version of Help and Support Center. This occurs because the URL Handler for the "hcp://" prefix contains an unchecked buffer.

An attacker may be able to exploit this vulnerability by creating a URL that, when clicked by the user, runs code chosen by the attacker in the Local Computer security context. The URL may be hosted on a Web site, or sent directly to the user through e-mail. In the Web-based scenario, where a user clicks the URL hosted on a Web site, an attacker may be able to read or run files already residing on the local computer. In an e-mail-born attack, if the user is using Microsoft Outlook Express 6.0 or Microsoft Outlook 2002 in the default configuration, or is using Microsoft Outlook 98 or Microsoft Outlook 2000 in conjunction with the Outlook E-mail Security Update available on the following Microsoft Web site an attack cannot be automated and the user must still click a URL sent through e-mail. However, if the user is not using Outlook Express 6.0 or Outlook 2002 in the default configuration, or is not using Outlook 98 or Outlook 2000 in conjunction with the Outlook E-mail Security Update, the attacker can trigger an attack automatically without the user having to click a URL contained in an e-mail message.

Mitigating Factors

• The Help and Support Center function cannot be started automatically in Outlook Express or Outlook if the user is running Microsoft Internet Explorer 6.0 Service Pack 1 (SP1).. For additional information about how to obtain Internet Explorer 6.0 SP1, click the following article number to view the article in the Microsoft Knowledge Base:

  328548 How to Obtain the Latest Service Pack for Internet Explorer 6

• For an attack to be successful, the user must visit a Web site under the attacker's control or receive an HTML e-mail message from the attacker.
• Automatic exploitation of the vulnerability by an HTML e-mail message is blocked by Outlook Express 6.0 and Outlook 2002 in their default configurations, and is blocked by Outlook 98 and Outlook 2000 if used in conjunction with the Outlook E-mail Security Update:

  http://www.microsoft.com/downloads/details.aspx?FamilyID=96DF48A9-7638-429E-816E-35F16F6528CA&displaylang=EN

   Date         Time   Version      Size     File name
   -----------------------------------------------------
   08-Jan-2003  14:24  4.90.0.3004  499,984  Helpctr.exe