Vulnerability Note VU#323070

The Cross Domain Security Model

IE uses a cross-domain security model to maintain separation between browser frames from different sources. This model is designed to prevent code in one domain from accessing data in a different domain. The Local Machine Zone is "...an implicit zone for content that exists on the local computer. The content found on the user's computer, except for content that Internet Explorer caches on the local system, is treated with a high level of trust." The determination of what zone and/or domain a URL exists in and what actions can be performed in that zone is made by the Internet Security Manager Object.

HTML Help

The Microsoft HTML Help system "...is the standard help system for the Windows platform." HTML Help components can be compiled to "...compress HTML, graphic, and other files into a relatively small compiled help (.chm) file...". The resulting compiled Help (CHM) file can then "...be distributed with a software application, or downloaded from the Web." The Help Viewer application "...uses the underlying components of Microsoft Internet Explorer to display help content. It supports HTML, ActiveX, Java, scripting languages (JScript, and Microsoft Visual Basic Scripting Edition)...".

The InfoTech Storage Format

CHM files use the Microsoft InfoTech Storage format (ITS). IE can access components within CHM files (via the IStorage interface) using several protocol handlers: ms-its, ms-itss, its, mk:@MSITStore.

For example, the following URL references an HTML file within a CHM file hosted on a remote web site:

ms-its:http://www.example.com/directory/path/compiledhelpfile.chm:/htmlfile.html

This URL references a local CHM file:

its:file://c:\directory\path\compiledhelpfile.chm:/htmlfile.html

MIME Encapsulation of Aggregate HTML Documents (MHTML)

MHTML (RFC 2110) provides a way to include multiple components of an HTML document (HTML, images, script, etc.) in a single MIME email message. Outlook Express implements an MHTML protocol handler (mhtml:), and Windows systems use IE to access MHTML URLs. The ITS protocol handlers can reference objects contained within MHTML documents:

ms-its:mhtml:file://c:\directory\path\mhtmlfile.mhtml

The ITS protocol handlers can specify an alternate location for MHTML content (URL is wrapped):

ms-its:mhtml:file://c:\file_does_not_exist.mhtml!http://www.example.com/directory/
path/compiledhelpfile.chm:/htmlfile.html

The Problem

If the MHTML protocol handler is unable to access the specified MHTML file, (for example, if the file does not exist) the handler will attempt to access the content specified by the alternate location. In the example above, the MHTML protocol handler incorrectly treats HTML content from one domain (htmlfile.html in example.com) as if it were in a different domain (file://, the Local Machine Zone). This is a violation of the cross-domain security model. Testing shows that the ms-its:, its:, and mk:@MSITStore: protocol handlers can act as attack vectors.

An attacker could exploit this vulnerability using a specially crafted URL and an HTML document containing script, an ActiveX object, or possibly an IFRAME element. Due to the way IE determines the MIME type of a file referenced by a URL, an HTML document may not necessarily have the expected file name extension (.html or .htm). Likewise, a CHM file may not have the expected .chm extension.

Functional exploit code is publicly available, and there are reports of incidents involving this vulnerability (e.g., the Ibiza trojan, variants of Bugbear, Bloodhound.Exloit.6).

Any program that uses the WebBrowser ActiveX control or the IE HTML rendering engine (MSHTML) may be affected by this vulnerability. Outlook and Outlook Express are affected.

By convincing a victim to view an HTML document (web page, HTML email), an attacker could execute script in a different security domain than the one containing the attacker's document. By causing script to be run in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE. The attacker could also read or modify data in other web sites and in the Local Machine Zone (read cookies/content, modify/create content, etc.).

Install a patch
Install the appropriate cumulative patch for Outlook Express according to Microsoft Security Bulletin MS04-013.

Note: Disabling Active scripting or ActiveX controls is not an effective workaround

Disabling Active scripting and ActiveX controls in any zone does not prevent the exploitation of this vulnerability. Disabling these features in the Internet and Local Machine Zones (see MS KB Article 833633) may stop some attacks.

Disable ITS and MHTML protocol handlers

Disabling the ITS and MHTML protocol handlers may prevent exploitation of this vulnerability. Delete or rename the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\{ms-its,ms-itss,its,mk,mhtml}