Windows Hsc Dvd Driver Upgrade

[Tami]

Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability
Risk
High

Date Discovered
05-11-2004

Description

A security vulnerability has been reported in Microsoft Windows XP and Server 2003 operating systems. This issue exists in the Help and Support Center (HSC) and is due to how the feature handles HCP invocation URIs for DVD driver upgrades.

This issue could be exploited from a malicious web page or HTML e-mail to cause a malicious executable to be run on a vulnerable system. This would occur in the context of the victim user, though it has been reported that significant user interaction is required for exploitation to occur.

While this issue may be exploited through Internet Explorer, it should also be noted that third-party web client software could also invoke HSC via a HCP URI.
Symantec Vulnerability Assessment
Symantec Vulnerability Assessment detects and reports this vulnerability. Click here for the advisory released May 11, 2004.

Symantec Enterprise Security Manager
Symantec Enterprise Security Manager™ posted an update to the OS Patch Policy that detects and reports systems that are not patched against this vulnerability. Click here for the advisory released May 11, 2004.

Components Affected
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Datacenter Edition 64-bit
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Enterprise Edition 64-bit
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows XP 64-bit Edition
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows XP 64-bit Edition Version 2003
Microsoft Windows XP Home SP1
Microsoft Windows XP Home
Microsoft Windows XP Professional SP1
Microsoft Windows XP Professional

Recommendations
Run all client software as a non-privileged user with minimal access rights.
All non-administrative tasks such as reading e-mail and browsing the web should be performed as an unprivileged user with minimal access rights. This will reduce the consequences of successful exploitation.

Do not follow links provided by unknown or untrusted sources.
This issue may be exploited from a malicious web page. Users should be wary of visiting websites of questionable integrity or following links provided by unfamiliar or suspicious sources.

Do not accept communications that originate from unknown or untrusted sources.
This issue may potentially be exploited via HTML e-mail. Disabling support for HTML e-mail in the mail client may limit exposure to this attack vector. HTML e-mail may also be filtered using other means.

Microsoft has released fixes to address this issue.


Microsoft Windows Server 2003 Datacenter Edition :
Microsoft Windows Server 2003 Datacenter Edition 64-bit :
Microsoft Windows Server 2003 Enterprise Edition :

Microsoft Upgrade Security Update for Windows Server 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows Server 2003 Enterprise Edition 64-bit :
Microsoft Upgrade Security Update for Microsoft Windows Server 2003 and Windows XP 64 Bit Edition Vers 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows Server 2003 Standard Edition :
Microsoft Upgrade Security Update for Windows Server 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows Server 2003 Web Edition :
Microsoft Upgrade Security Update for Windows Server 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP 64-bit Edition SP1:
Microsoft Upgrade Security Update for Windows XP 64 Bit Edition (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP 64-bit Edition :
Microsoft Upgrade Security Update for Windows XP 64 Bit Edition (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP 64-bit Edition Version 2003 SP1:
Microsoft Upgrade Security Update for Windows XP 64 Bit Edition (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en
Microsoft Upgrade Security Update for Microsoft Windows Server 2003 and Windows XP 64 Bit Edition Vers 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en
Microsoft Upgrade Security Update for Windows XP 64 Bit Edition 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP 64-bit Edition Version 2003 :
Microsoft Upgrade Security Update for Windows XP 64 Bit Edition (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en
Microsoft Upgrade Security Update for Microsoft Windows Server 2003 and Windows XP 64 Bit Edition Vers 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en
Microsoft Upgrade Security Update for Windows XP 64 Bit Edition 2003 (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP Home SP1:
Microsoft Upgrade Security Update for Windows XP (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP Home :
Microsoft Upgrade Security Update for Windows XP (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP Professional SP1:
Microsoft Upgrade Security Update for Windows XP (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en

Microsoft Windows XP Professional :
Microsoft Upgrade Security Update for Windows XP (KB840374)
http://www.microsoft.com/downloads/deta ... laylang=en
References
Source: EXPL-A-2003-027 exploitlabs.com Advisory 027
URL: http://www.exploitlabs.com/files/adviso ... elpctr.txt

Source: Microsoft Security Bulletin MS04-015
URL: http://www.microsoft.com/technet/securi ... 4-015.mspx

Credits
Discovery is credited to Donnie Werner.

--------------------------------------------------------------------------------

Copyright © 2004 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response.

Source