The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Vulnerability in Microsoft Windows Allows Code Execution (MS06-043)
------------------------------------------------------------------------
SUMMARY
There is a remote code execution vulnerability in Windows that results
from incorrect parsing of the MHTML protocol. An attacker could exploit
the vulnerability by constructing a specially crafted Web page or HTML
e-mail that could potentially lead to remote code execution if a user
visited a specially crafted Web site or clicked a link in a specially
crafted e-mail message.
DETAILS
Affected Software:
* Microsoft Windows XP Service Pack 2
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows Server 2003 Service Pack 1
* Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition
Tested Microsoft Windows Components:
Affected Components:
Outlook Express 6 on Microsoft Windows XP Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=c9037cdb-3a57-4db7-aa0d-5ad28730303a>
Download the update
Outlook Express 6 on Microsoft Windows XP Professional x64 Edition -
<http://www.microsoft.com/downloads/details.aspx?familyid=71f09617-d3cd-45fb-a09b-a9025c1d3f47>
Download the update
Outlook Express 6 on Microsoft Windows Server 2003 Service Pack 1 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=0c7e507f-2a42-49b5-82b2-84a6ec40b895>
Download the update
Outlook Express 6 on Microsoft Windows Server 2003 with SP1 for
Itanium-based Systems -
<http://www.microsoft.com/downloads/details.aspx?familyid=8f062b1c-7b93-4cb2-835a-b58ba29435f2>
Download the update
Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=2aa6b4d1-a6eb-425b-ab7e-6cc27124a59e>
Download the update
Non-Affected Software:
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 1
Microsoft Windows Server 2003
Microsoft Windows Server 2003 for Itanium-based Systems
MHTML Parsing Vulnerability - CVE-2006-2766:
If a user were logged on with administrative user rights, an attacker who
successfully exploited this vulnerability could take complete control of
an affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts with full user rights. Users whose
accounts are configured to have fewer user rights on the system could be
less affected than users who operate with administrative user rights.
Mitigating Factors for MHTML Parsing Vulnerability - CVE-2006-2766:
* In a Web-based attack scenario, an attacker could host a Web site that
contains a Web page that is used to exploit this vulnerability. In
addition, compromised Web sites and Web sites that accept or host
user-provided content or advertisements could contain specially crafted
content that could exploit this vulnerability. In all cases, however, an
attacker would have no way to force users to visit these Web sites.
Instead, an attacker would have to persuade users to visit the Web site,
typically by getting them to click a link in an e-mail message or instant
messenger message that takes users to the attacker's Web site.
* An attacker who successfully exploited this vulnerability could gain
the same user rights as the local user. Users whose accounts are
configured to have fewer user rights on the system could be less impacted
than users who operate with administrative user rights.
* By default, Outlook Express 6 opens HTML e-mail messages in the
Restricted sites zone.
The Restricted sites zone helps limit attacks that could try to exploit
this vulnerability by preventing ActiveX Controls from being used when
reading HTML e-mail messages. However, if a user clicks a link in an
e-mail message, the use could still be vulnerable to this issue through
the Web-based attack scenario.
* By default, Internet Explorer on Windows Server 2003 runs in a
restricted mode that is known as Enhanced Security Configuration. This
mode mitigates this vulnerability in the e-mail vector because reading
e-mail messages in plain text is the default configuration for Outlook
Express. See the FAQ section for this security update for more information
about Internet Explorer Enhanced Security Configuration.
Workarounds for MHTML Parsing Vulnerability - CVE-2006-2766:
Microsoft has tested the following workarounds. Although these workarounds
will not correct the underlying vulnerability, they help block known
attack vectors. When a workaround reduces functionality, it is identified
in the following section.
* Modify the Access Control List to disable the MHTML Protocol registry
key
Modifying the Access Control List on the MHTML Protocol registry key
helps protect the affected system from attempts to exploit this
vulnerability. To modify the MHTML Protocol registry key, follow these
steps.
Note Using Registry Editor incorrectly can cause serious problems that may
require you to reinstall your operating system. Microsoft cannot guarantee
that problems resulting from the incorrect use of Registry Editor can be
solved. Use Registry Editor at your own risk. For information about how to
edit the registry, view the "Changing Keys And Values" Help topic in
Registry Editor (Regedit.exe) or view the "Add and Delete Information in
the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.
Note We recommend backing up the registry before you edit it.
Note Make a note of the permissions that are listed in the dialog box so
that you can restore them to their original values at a later time
1. Click Start, click Run, type "regedit" (without the quotation marks),
and then click OK.
2. Expand HKEY_CLASSES_ROOT, expand CLSID, and then click
{05300401-BCBC-11d0-85E3-00C04FD85AB4}.
3. Click Edit, and then click Permissions.
4. Click Advanced.
5. Click to clear the Inherit from parent the permission entries that
apply to child objects. Include these with entries explicitly defined
here. check box. You are prompted to click Copy, Remove, or Cancel. Click
Remove, and then check OK.
6. You receive a message that states that no one will be able to access
this registry key. Click Yes, and then click OK to close the Permissions
for {05300401-BCBC-11d0-85E3-00C04FD85AB4} dialog box.
Impact of Workaround: This workaround disables page rendering for MHTML
Web pages.
FAQ for MHTML Parsing Vulnerability - CVE-2006-2766:
What is the scope of the vulnerability?
There is a remote code execution vulnerability in Windows that results
from incorrect parsing of the MHTML protocol. An attacker could exploit
the vulnerability by constructing a specially crafted Web page or HTML
e-mail that could potentially lead to remote code execution if a user
visited a specially crafted Web site or clicked a link in a specially
crafted e-mail message.
If a user were logged on with administrative user rights, an attacker who
successfully exploited this vulnerability could take complete control of
an affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts with full user rights. Users whose
accounts are configured to have fewer user rights on the system could be
less affected than users who operate with administrative user rights.
What causes the vulnerability?
Windows incorrectly parses the MHTML protocol.
What is MHTML?
MHTML extends HTML to embed encoded objects, such as images, in the HTML
document. Although it is actually the HTML rendering extension that
renders MHTML, this functionality may also be referred to as the MHTML
rendering extension.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take
complete control of the affected system.
What are Internet Explorer security zones?
Internet Explorer security zones are part of a system that divides online
content into categories or zones, based on the trustworthiness of the
content. Specific Web domains can be assigned to a zone, depending on how
much trust is put in the content of each domain. The zone then restricts
the capabilities of the Web content, based on the zone's policy. By
default, most Internet domains are treated as part of the Internet zone.
By default, the policy of the Internet zone prevents scripts and other
active code from accessing resources on the local system.
How could an attacker exploit the vulnerability?
An attacker could host a specially crafted Web site or HTML e-mail message
that is designed to exploit this vulnerability through Internet Explorer
and then persuade a user to view the Web site or HTML e-mail message. This
can also include Web sites that accept user-provided content or
advertisements, Web sites that host user-provided content or
advertisements, and compromised Web sites. These Web sites could contain
specially crafted content that could exploit this vulnerability. In all
cases, however, an attacker would have no way to force users to visit
these Web sites. Instead, an attacker would have to persuade users to
visit the Web site, typically by getting them to click a link in an e-mail
message or in an Instant Messenger request that takes users to the
attacker's Web site. It could also be possible to display specially
crafted Web content by using banner advertisements or by using other
methods to deliver Web content to affected systems.
What systems are primarily at risk from the vulnerability?
This vulnerability requires a user to be logged on and visiting a Web site
for any malicious action to occur. Therefore, any systems where Internet
Explorer is used frequently, such as workstations or terminal servers, are
at the most risk from this vulnerability.
What does the update do?
The update removes the vulnerability by changing Windows so that it
correctly parses the MHTML protocol.
When this security bulletin was issued, had this vulnerability been
publicly disclosed?
Yes. This vulnerability has been publicly disclosed. It has been assigned
Common Vulnerability and Exposure number CVE-2006-2766.
When this security bulletin was issued, had Microsoft received any reports
that this vulnerability was being exploited?
No. Microsoft had seen examples of proof of concept code published
publicly but had not received any information to indicate that this
vulnerability had been publicly used to attack customers when this
security bulletin was originally issued.
Does applying this security update help protect customers from the code
that has been published publicly that attempts to exploit this
vulnerability?
Yes. This security update addresses the vulnerability that potentially
could be exploited by using the published proof of concept code. The
vulnerability that has been addressed has been assigned the Common
Vulnerability and Exposure number CVE-2006-2766.
ADDITIONAL INFORMATION
The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/Bulletin/MS06-043.mspx>
http://www.microsoft.com/technet/security/Bulletin/MS06-043.mspx
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
