O-007: Microsoft Windows Help and Support Center Buffer Overrun Vulnerability

REVISION HISTORY:
10/17/03 - added links to CERT Advisory CA-2003-27 and Next Generation Security Software Limited. 
10/23/03 - updated the download link for Windows XP 64 Bit Edition Version 2003 patch in MS03-044. 


[***** Start Microsoft Security Bulletin MS03-044 *****]

Microsoft Security Bulletin MS03-044


Buffer Overrun in Windows Help and Support Center Could Lead to System 
Compromise (825119)
Issued: October 15, 2003
Version Number: 1.0 

Summary
Who Should Read This Document:  Customers using Microsoft® Windows®

Impact of Vulnerability:  Remote Code Execution

Maximum Severity Rating:  Critical

Recommendation:  Customers should install the patch immediately

Patch Replacement:  None

Caveats:  None

Tested Software and Patch Download Locations: 

Affected Software: 

Microsoft Windows Millennium Edition 
   - Download the patch 
Microsoft Windows NT Workstation 4.0, Service Pack 6a 
   - Download the patch 
Microsoft Windows NT Server 4.0, Service Pack 6a 
   - Download the patch 
Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6 
   - Download the patch 
Microsoft Windows 2000, Service Pack 2 
   - Download the patch 
Microsoft Windows 2000, Service Pack 3, Service Pack 4 
   - Download the patch 
Microsoft Windows XP Gold, Service Pack 1 
   - Download the patch 
Microsoft Windows XP 64-bit Edition 
   - Download the patch 
Microsoft Windows XP 64-bit Edition Version 2003 
   - Download the patch 
Microsoft Windows Server 2003 
   - Download the patch 
Microsoft Windows Server 2003 64-bit Edition 
   - Download the patch 

Non Affected Software: 
None 

The software listed above has been tested to determine if the versions 
are affected. Other versions are no longer supported, and may or may not 
be affected. 


Technical Details
Technical Description:

A security vulnerability exists in the Help and Support Center function 
which ships with Windows XP and Windows Server 2003. The affected code is 
also included in all other supported Windows operating systems, although 
no known attack vector has been identified at this time because the HCP 
protocol is not supported on those platforms. The vulnerability results 
because a file associated with the HCP protocol contains an unchecked buffer.

An attacker could exploit the vulnerability by constructing a URL that, 
when clicked on by the user, could execute code of the attacker’s choice 
in the Local Computer security context. The URL could be hosted on a web 
page, or sent directly to the user in email. In the web based scenario, 
where a user then clicked on the URL hosted on a website, an attacker 
could have the ability to read or launch files already present on the 
local machine.

The risk of attack from the HTML email vector can be significantly reduced 
if the following conditions are met:

- You have applied the patch included with Microsoft Security bulletin 
  MS03-040 
- You are using Internet Explorer 6 or later 

- You are using the Microsoft Outlook Email Security Update or Microsoft 
Outlook Express 6.0 and higher, or Microsoft Outlook 2000 or higher in their 
default configuration.
 
Mitigating factors: 

The Help and Support Center function can not be started automatically in
Outlook Express or Outlook if the user is running Internet Explorer 6.0 
Service Pack 1. 

In the Web based attack scenario, the attacker would have to host a web 
site that contained a web page used to exploit these vulnerabilities. An 
attacker would have no way to force users to visit a malicious web site 
outside of the HTML email vector. Instead, the attacker would need to 
lure them there, typically by getting them to click on a link that would 
take them to the attacker's site. 

Severity Rating:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Windows Millennium Edition                        Low
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
Windows NT Server 4.0                             Low
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
Windows NT Server 4.0, Terminal Server Edition    Low
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
Windows 2000                                      Low
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
Windows XP                                        Critical
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
Windows Server 2003                               Critical 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

The above assessment is based on the types of systems affected by the 
vulnerability, their typical deployment patterns, and the effect that 
exploiting the vulnerability would have on them. 

Vulnerability identifier: CAN-2003-0711 


Workarounds

Microsoft has tested the following workarounds. These workarounds will not 
correct the underlying vulnerability however they help block known attack 
vectors. Workarounds may cause a reduction in functionality in some 
cases – in such situations this is identified below.

- Deregister the HCP Protocol. 
Deregistering the HCP Protocol or changing the registration will prevent an 
attack from being successful. The protocol can be deregistered by deleting 
the following key from the registry: HKEY_CLASSES_ROOT\HCP. 

1. From the Start Menu, select Run 
2. Type regedit then click OK (The registry editor program launches) 
3. Expand HKEY_CLASSES_ROOT and highlight the HCP key 
4. Right mouse click on the HCP key, and select Delete 

WARNING: Using Registry Editor incorrectly can cause serious problems that 
may require you to reinstall Windows. Microsoft cannot guarantee that 
problems resulting from the incorrect use of Registry Editor can be solved. 
Use Registry Editor at your own risk. 

Impact of Workaround: Deregistering the HCP protocol will break all local, 
legitimate help links that use hcp://. For example links in the Control 
Panel may no longer function. 

- Install Outlook Email Security Update if you are using Outlook 2000 SP1 
or Earlier.
 
The Outlook Email Security Update causes Outlook 98 and 2000 to open HTML 
mail in the Restricted Sites Zone by default. Outlook Express 6.0 and 
Outlook 2002 by default open HTML mail in the Restricted Sites Zone. 
Customers who use any of these products would be at a reduced risk from 
an e-mail borne attack that attempts to exploit this vulnerability unless 
the user clicks a malicious link in the email 

- If you are using Outlook 2002 or Outlook Express 6.0SP1 or higher, to 
help protect yourself from the HTML email attack vector, read email in 
plain text format. 

Users of Microsoft Outlook 2002 and Outlook Express 6.0 who have applied 
Service Pack 1 and or higher can enable a feature to view all 
non-digitally-signed e-mail or non-encrypted e-mail messages in plain 
text only.

Digitally signed e-mail or encrypted e-mail messages are not affected by the 
setting and may be read in their original formats. Information on enabling 
this setting in Outlook 2002 can be found in the following Knowledge Base 
article: 

http://support.microsoft.com/default.aspx?scid=kb;en-us;307594

Information on enabling this setting in Outlook Express 6.0 can be found 
in the following Knowledge Base article:

http://support.microsoft.com/?kbid=291387 

Impact of Workaround: 
E-mail viewed in plain text format cannot contain pictures, specialized 
fonts, animations, or other rich content. In addition: 

The changes are applied to the preview pane and open messages. 
Pictures become attachments to avoid loss. 

Since the message is still in Rich Text or HTML format in the store, the 
object model (custom code solutions) may behave unexpectedly because the 
message is still in Rich Text or HTML format in the mail store. 


Security Patch Information
Installation Platforms and Prerequisites: 

For information about the specific security patch for your platform, click 
the appropriate link: 


Windows Server 2003 (all versions)
Windows XP (all versions)
Windows 2000 (all versions)
Windows NT 4.0 (all versions)
Windows Me (all versions)

Acknowledgments

Microsoft thanks the following for working with us to protect customers: 

David Litchfield of Next Generation Security Software Ltd. for reporting 
the issue in MS03-044. 


Obtaining other security patches:

Patches for other security issues are available from the following 
locations: 

Security patches are available from the Microsoft Download Center, and 
can be most easily found by doing a keyword search for "security_patch".
 
Patches for consumer platforms are available from the WindowsUpdate web site


Support:

Technical support is available from Microsoft Product Support Services at 
1-866-PCSAFETY. There is no charge for support calls associated with 
security patches. 

Security Resources: 

The Microsoft TechNet Security Web Site provides additional information 
about security in Microsoft products. 

Microsoft Software Update Services: http://www.microsoft.com/sus/ 
Microsoft Baseline Security Analyzer (MBSA) details: 
    http://www.microsoft.com/mbsa. 
Please see http://support.microsoft.com/default.aspx?scid=kb;EN-US;306460for 
list of security patches that have detection limitations with MBSA tool. 
Windows Update Catalog: 
   http://support.microsoft.com/default.aspx?scid=kb;EN-US;323166 
Windows Update: http://windowsupdate.microsoft.com 
Office Update: http://office.microsoft.com/officeupdate/ 

Disclaimer:

The information provided in the Microsoft Knowledge Base is provided 
"as is" without warranty of any kind. Microsoft disclaims all warranties, 
either express or implied, including the warranties of merchantability and 
fitness for a particular purpose. In no event shall Microsoft Corporation 
or its suppliers be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages, even if Microsoft Corporation or its suppliers have been advised 
of the possibility of such damages. Some states do not allow the exclusion 
or limitation of liability for consequential or incidental damages so the
foregoing limitation may not apply.

Revisions:

V1.0 (October 15, 2003): Bulletin published.
V1.1 October 22, 2003: Updated download link for Windows XP 64 bit edition 
Version 2003.


[***** End Microsoft Security Bulletin MS03-044 *****]

    Voice:          +1 866-941-2472 (7 x 24)
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov/