Vulnerability Note VU#260588

Microsoft Windows Help and Support Center (HCP) fails to validate HCP URLs

Overview

A remotely exploitable vulnerability exists in the Help and Support Center (HCP). An attacker could compromise the victim's system by tricking them into visiting a malicious web site, or viewing a malicious email message.

I. Description

A failure to filter special characters, such as quotes, from HCP URLs could lead to inject code into the . By tricking a victim in to visiting a malicious web site, or viewing a malicious email, the remote attacker could exploit this vulnerability to remotely execute code in the "MyComputer" zone. The following systems are affected by this issue:

Windows XP
Windows Server 2003

II. Impact

A remote attacker could exploit this vulnerability to execute code in the "MyComputer" zone with the privileges of the current user.

III. Solution

Apply a patch from the vendor

Microsoft Security Bulletin MS04-011 contains patch information to resolve this issue.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	14-Apr-2004

References

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.idefense.com/application/poi/display?id=100&type=vulnerabilities

Credit

Thanks to Jouko Pynn�nen for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public:	2004-04-13
Date First Published:	2004-04-14
Date Last Updated:	2004-04-14
CERT Advisory:
CVE-ID(s):	CAN-2003-0907
NVD-ID(s):	CAN-2003-0907
US-CERT Technical Alerts:
Metric:	35.10
Document Revision:	2

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader