Vulnerability Note VU#578319

Microsoft Windows Help and Support Center URI processing vulnerability

Overview

The Microsoft Windows Help and Support Center application fails to properly sanitize hcp:// URIs, which can allow a remote, unauthenticated attacker to execute arbitrary commands.

I. Description

Microsoft Windows Help and Support Center is the default handler for the hcp protocol on Windows XP and 2003 systems. When an hcp:// URI is encountered, Windows will launch the Help and Support Center application, which is provided by helpctr.exe. When helpctr.exe is invoked from an hcp:// URI, it operates in a more restricted mode by using the -FromHCP command-line parameter. This is supposed to restrict the Help and Support Center to a whitelisted set of help documents and parameters.

The UrlUnescape function that is used by helpctr.exe contains an error that allows an attacker to bypass the whitelist restrictions provided by the -FromHCP option. By leveraging an XSS vulnerability in an existing Help and Support Center document, an attacker can inject arbitrary script commands into a Help and Support Center session. Because the Help and Support Center documents are located in a trusted zone, this can allow arbitrary Windows commands to be executed.

II. Impact

By causing Microsoft Windows to handle a specially crafted hcp:// URI, a remote, unauthenticated attacker can execute arbitrary commands with the privileges of the user. This can happen as the result of viewing a specially crafted webpage, opening a Windows Media Player file, or through the use of other attack vectors.

III. Solution

Apply an update

This issue is addressed in Microsoft Security Bulletin MS10-042.

Disable the HCP protocol handler

This vulnerability can be mitigated by removing the HCP protocol handler. This can be accomplished by removing the HKEY_CLASSES_ROOTHCPshellopen registry key. Note that this may interfere with Windows functionality that relies on the HCP protocol.

Secure your web browser

This vulnerability can be mitigated by following the guidelines outlined in the Securing Your Web Browser document. This can help mitigate attacks that use web browsers as attack vectors.

Update Windows Media Player

A fully patched Windows XP system will come with Windows Media Player 9 by default. Windows Media Player versions 10 and later have some security improvements, such as prompting before loading external web content. Although it does not address the underlying vulnerability, upgrading to Windows Media Player 10 or later can help mitigate some attack vectors by prompting the user.

Vendor Information

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Affected	2010-06-10	2010-07-13

References

http://www.us-cert.gov/reading_room/securing_browser/
http://www.microsoft.com/technet/security/Bulletin/MS10-042.mspx
http://seclists.org/fulldisclosure/2010/Jun/205
http://www.microsoft.com/technet/security/advisory/2219475.mspx
http://blogs.technet.com/b/msrc/archive/2010/06/10/windows-help-vulnerability-disclosure.aspx
http://blogs.technet.com/b/srd/archive/2010/06/10/help-and-support-center-vulnerability-full-disclosure-posting.aspx
http://technet.microsoft.com/en-us/library/bb490918.aspx
http://msdn.microsoft.com/en-us/library/bb773791%28VS.85%29.aspx
http://secunia.com/advisories/40076
http://www.theregister.co.uk/2010/06/10/windows_help_bug/

Credit

This vulnerability was discovered and publicly reported by Tavis Ormandy.

This document was written by Will Dormann.

Other Information

Date Public:	2010-06-09
Date First Published:	2010-06-10
Date Last Updated:	2010-07-13
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	43.38
Document Revision:	31