(Vendor Issues Fix for Outlook Express) Microsoft Internet Explorer Security Domain Flaw in Accessing CHM Files Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1009755 |
|
SecurityTracker URL: http://securitytracker.com/id/1009755
|
|
CVE Reference:
CAN-2004-0380
(Links to External Site)
|
Date: Apr 13 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 5.5, 6
|
Description:
A cross-domain security vulnerability was reported in Microsoft Internet Explorer in the processing of CHM compiled help files via the ms-its and related protocol handlers. A remote user can execute arbitrary code on the target user's system. Microsoft Outlook Express is affected.
It is reported that the 'ms-its', 'ms-itss', 'its', and 'mk:@MSITStore' protocol handlers do not properly do not properly determine the appropriate security domain when accessing MIME-encapsulated HTML files (MHTML files) within CHM files. A remote user can create HTML that, when loaded by the target user, will run scripting code in the Local Computer security zone. This permits arbitrary code execution.
The malicious HTML can attempt to access an HTML file within a local MHTML file that does not exist. This reportedly will cause Internet Explorer to attempt to access the file from a remote location but incorrectly execute the file in the Local Computer security zone.
It is reported that any application that uses the WebBrowser ActiveX control or the Internet Explorer HTML rendering engine (MSHTML) may be vulnerable (for example, Outlook and Outlook Express are affected).
Thor Larholm is credited by K-OTik Security with reporting this flaw.
|
Impact:
A remote user can execute arbitrary code on the target user's system.
|
Solution:
The following patches are available:
Microsoft Outlook Express 5.5 SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=88D8F9DC-589A-4CE5-BB04-CCEDCB8ADDBA&displaylang=en
Microsoft Outlook Express 6:
http://www.microsoft.com/downloads/details.aspx?FamilyId=DCEB332E-CAE4-4743-B6AB-EDC1CD625AE0&displaylang=en
Microsoft Outlook Express 6 SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=925628BD-1B5F-4B21-8DB6-EDE1C73F97B5&displaylang=en
Microsoft Outlook Express 6 SP1 (64 bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=DEDBA3EA-05EC-45AF-8795-5F785D83CA77&displaylang=en
Microsoft Outlook Express 6 on Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1C44FB27-6A9D-42AE-8E06-3ADBB7896BCD&displaylang=en
Microsoft Outlook Express 6 on Windows Server 2003 (64 bit edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=C765E4F3-19A4-45CF-BE99-28C136B14E30&displaylang=en
This bulletin supercedes MS03-014.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-013.mspx (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Windows (NT), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 13 Apr 2004 15:42:45 -0400
Subject: MS04-013
|
http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx
> Microsoft Security Bulletin MS04-013
> Cumulative Security Update for Outlook Express (837009)
> Issued: April 13, 2004
> Maximum Severity Rating: Critical
Microsoft issued a cumulative patch for Outlook Express. The patch includes a fix for the
MHTML URL Processing Vulnerability (CAN-2004-0380).
Outlook Express versions 5.5 and 6 are affected on Windows NT 4.0, 2000, XP, and 2003.
Microsoft has assigned a maximum severity rating of 'Critical' to this vulnerability.
The following patches are available:
Microsoft Outlook Express 5.5 SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=88D8F9DC-589A-4CE5-BB04-CCEDCB8ADDBA&displaylang=en
Microsoft Outlook Express 6:
http://www.microsoft.com/downloads/details.aspx?FamilyId=DCEB332E-CAE4-4743-B6AB-EDC1CD625AE0&displaylang=en
Microsoft Outlook Express 6 SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=925628BD-1B5F-4B21-8DB6-EDE1C73F97B5&displaylang=en
Microsoft Outlook Express 6 SP1 (64 bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=DEDBA3EA-05EC-45AF-8795-5F785D83CA77&displaylang=en
Microsoft Outlook Express 6 on Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1C44FB27-6A9D-42AE-8E06-3ADBB7896BCD&displaylang=en
Microsoft Outlook Express 6 on Windows Server 2003 (64 bit edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=C765E4F3-19A4-45CF-BE99-28C136B14E30&displaylang=en
This bulletin supercedes MS03-014.
|
|
