Vulnerability Note VU#260588

Microsoft Windows Help and Support Center (HCP) fails to validate HCP URLs

Overview

A remotely exploitable vulnerability exists in the Help and Support Center (HCP). An attacker could compromise the victim's system by tricking them into visiting a malicious web site, or viewing a malicious email message.

I. Description

A failure to filter special characters, such as quotes, from HCP URLs could lead to inject code into the . By tricking a victim in to visiting a malicious web site, or viewing a malicious email, the remote attacker could exploit this vulnerability to remotely execute code in the "MyComputer" zone. The following systems are affected by this issue:

Windows XP
Windows Server 2003

II. Impact

A remote attacker could exploit this vulnerability to execute code in the "MyComputer" zone with the privileges of the current user.

III. Solution

Apply a patch from the vendor

Microsoft Security Bulletin MS04-011 contains patch information to resolve this issue.

Systems Affected

Vendor	Status	Date Updated
Microsoft Corporation	Vulnerable	14-Apr-2004

References

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.idefense.com/application/poi/display?id=100&type=vulnerabilities

Credit

Thanks to Jouko Pynn�nen for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public	04/13/2004
Date First Published	04/14/2004 02:52:31 AM
Date Last Updated	04/14/2004
CERT Advisory
CVE-ID(s)	CAN-2003-0907
NVD-ID(s)	CAN-2003-0907
US-CERT Technical Alerts
Metric	35.10
Document Revision	2

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader