|
Brought to you by:
Suppliers of:
|
|
|
| |
| A security vulnerability exists in the Microsoft Local Troubleshooter ActiveX control. The vulnerability exists because the ActiveX control (Tshoot.ocx) contains a buffer overflow that could allow an attacker to run code of their choice on a user?s system. Because this control is marked "safe for scripting", an attacker could exploit this vulnerability by convincing a user to view a specially crafted HTML page that references this ActiveX control. The Microsoft Local Troubleshooter ActiveX control is installed as a default part of the operating system on Windows 2000. |
| |
Credit:
The original article can be found at: http://www.microsoft.com/technet/security/bulletin/MS03-042.asp
|
| |
Vulnerable Systems:
* Microsoft Windows 2000, Service Pack 2
* Microsoft Windows 2000, Service Pack 3, Service Pack 4
Immune Systems:
* Microsoft Windows NT 4.0
* Microsoft Windows NT Server 4.0, Terminal Server Edition
* Microsoft Windows Millennium Edition
* Microsoft Windows XP
* Microsoft Windows Server 2003
The software listed above has been tested to determine if the versions are affected. Other versions are no longer supported, and may or may not be affected.
CVE Information:
CAN-2003-0661
Patch Availability:
* Microsoft Windows 2000, Service Pack 2
* Microsoft Windows 2000, Service Pack 3, Service Pack 4
To exploit this vulnerability, the attacker would have to create a specially formed HTML-based e-mail and send it to the user. Alternatively an attacker would have to host a malicious Web site that contained a Web page designed to exploit this vulnerability.
In the worst case, this vulnerability could allow an attacker to load malicious code onto a user's system and then to execute the code. The code would run in the context of the user. Therefore, the code is limited to any action that the legitimate user could take on the system. Any limitations on the user's account would also limit the actions of any arbitrary code that the attacker could execute.
The risk of attack from the HTML email vector can be significantly reduced if the following conditions are met:
* You have applied the patch included with Microsoft Security bulletin MS03-040
* You are using Internet Explorer 6 or later
* You are using the Microsoft Outlook Email Security Update or Microsoft Outlook Express 6.0 and higher, or Microsoft Outlook 2000 or higher in their default configuration.
Mitigating factors:
* A Web-based attack would only be successful if the attacker creates a Web site that contains a Web page that they use to exploit this vulnerability. An attacker would have no way to force users to visit the malicious Web site. Instead, the attacker would have to lure them there, typically by getting them to click a link in an email message that would takes them to the attacker's site.
* By default, Outlook Express 6.0 and Outlook 2002 open HTML mail in the Restricted Sites Zone. In addition, Outlook 98 and 2000 open HTML mail in the Restricted Sites Zone if the Outlook Email Security Update has been installed. Customers who use any of these products would be at a reduced risk from an e-mail borne attack that attempted to exploit this vulnerability unless the user clicked a malicious link in the email.
* An attacker?s code could only run with the same permissions as the logged on user. The specific privileges the attacker could gain through this vulnerability would therefore depend on the privileges granted to the user. Any limitations on the user's account would also limit the actions of any arbitrary code executed by this vulnerability.
Workarounds:
Microsoft has tested the following workarounds. These workarounds will not correct the underlying vulnerability however they help block known attack vectors. Workarounds may cause a reduction in functionality in some cases - in such situations this is identified below.
* Prompt before running of ActiveX controls in the Internet and Intranet zones: You can help protect against this vulnerability by changing your settings for the Internet security zone to prompt before running ActiveX components. To do this, perform the following steps:
1. In Internet Explorer, select Tools, Internet Options
2. Click on the Security tab
3. Highlight the Internet icon and click on the Custom Level button
4. Scroll through the list to the Active X controls and plug-ins section
5. Under Run ActiveX controls and plug-ins click Prompt
6. Click OK
7. Highlight the Local Intranet icon and click on the Custom Level button
8. Scroll through the list to the Active X controls and plug-ins section
9. Under Run ActiveX controls and plug-ins click Prompt
10. Click OK; then click OK again to return to Internet Explorer
Impact of Workaround:
Many Web sites on the Internet use ActiveX to provide additional functionality. For instance, an online e-commerce site or banking site might use ActiveX controls to provide menus, ordering forms, or even account statements. Prompting before running ActiveX controls is a global setting for all Internet and Intranet sites. You will be prompted frequently when you enable this work-around. For each prompt, if you feel you trust the site that you are visiting, click Yes to run ActiveX components. If you do not want to be prompted for all of these sites, you can instead use the "Restrict Web sites to only your trusted Web sites" workaround.
* Restrict Web sites to only your trusted Web sites. After requiring a prompt before running ActiveX in the Internet and Intranet zone, you can add sites that you trust into Internet Explorer?s Trusted sites. This will allow you to continue using trusted Web sites exactly as you do today, while protecting you from this attack on untrusted sites. Microsoft recommends that you only add sites that you trust to the trusted sites zone.
To do this, perform the following steps:
1. In Internet Explorer, select Tools, then Internet Options. Click the Security tab.
2. In the box labeled Select a Web content zone to specify its current security settings, click Trusted Sites, then click Sites.
3. If you want to add sites that do not require an encrypted channel, click to clear the Require server verification (https:) for all sites in this zone check box.
4. In the box labeled Add this Web Site to the zone, type the URL of a site that you trust, then click the Add button.
Repeat for each site that you want to add to the zone.
5. Click OK twice to accept the changes and return to Internet Explorer. Add any sites that you trust not to take malicious action on your computer. One in particular that you may want to add is "*.windowsupdate.microsoft.com" (without the quotes). This is the site that will host the patch, and it requires the use of an ActiveX control to install the patch.
Impact of Workaround:
For those sites you have not configured to be in your Trusted sites zone, their functionality will be impaired if they require ActiveX controls to function properly. Adding sites to your Trusted sites zone will allow them to be able to download the ActiveX control required to function correctly. However you should only add Web sites you trust to the Trusted sites zone.
* Install Outlook Email Security Update if you are using Outlook 2000 SP1 or Earlier.
The Outlook Email Security Update causes Outlook 98 and 2000 to open HTML mail in the Restricted Sites Zone by default. Outlook Express 6.0 and Outlook 2002 by default open HTML mail in the Restricted Sites Zone. Customers who use any of these products would be at a reduced risk from an e-mail borne attack that attempts to exploit this vulnerability unless the user clicks a malicious link in the email
* If you are using Outlook 2002 or Outlook Express 6.0SP1 or higher, to help protect yourself from the HTML email attack vector, read email in plain text format.
Users of Microsoft Outlook 2002 and Outlook Express 6.0 who have applied Service Pack 1 and or higher can enable a feature to view all non-digitally-signed e-mail or non-encrypted e-mail messages in plain text only.
Digitally signed e-mail or encrypted e-mail messages are not affected by the setting and may be read in their original formats. Information on enabling this setting in Outlook 2002 can be found in the following Knowledge Base article:
http://support.microsoft.com/default.aspx?scid=kb;en-us;307594
Information on enabling this setting in Outlook Express 6.0 can be found in the following Knowledge Base article:
http://support.microsoft.com/?kbid=291387
Impact of Workaround:
E-mail viewed in plain text format cannot contain pictures, specialized fonts, animations, or other rich content. In addition:
* The changes are applied to the preview pane and open messages.
* Pictures become attachments to avoid loss.
* Since the message is still in Rich Text or HTML format in the store, the object model (custom code solutions) may behave unexpectedly because the message is still in Rich Text or HTML format in the mail store.
Frequently Asked Questions
What is the scope of the vulnerability?
This is a buffer overrun vulnerability. An attacker who successfully exploited the vulnerability could, in the worst case, run code of their choice on a user?s system. This would enable an attacker to take any action the legitimate user could take. This could include creating, modifying or deleting data, This could also include reconfiguring the system, or reformatting the hard disk.
What causes the vulnerability?
The vulnerability results because the Microsoft Local Troubleshooter ActiveX control (Tshoot.ocx) does not correctly validate parameters under certain circumstances. By luring a user into viewing a specially-crafted Web page, or by sending them a specially-crafted email, an attacker could cause the ActiveX control to fail in such a way that could allow an attacker to run arbitrary code.
What's ActiveX?
ActiveX? is a technology that enables developers to write small programs that are named controls. Web pages, Visual Basic? programs, and other applications can use controls. An ActiveX control performs a small number of related tasks and can be used as building blocks in much more complex programs.
Developers can build custom ActiveX controls. If developers build custom ActiveX controls, the controls must be distributed to each user. However, Microsoft and many third-party software vendors include ActiveX controls with their products, to enable these products to be easily extended. The vulnerability in this case involves an ActiveX control that installs by default as part of the operating system.
Which ActiveX controls contain the vulnerability?
The Microsoft Windows Help system is a default component of Windows. This Help system features documentation and interactive troubleshooting wizards that help users diagnose common problems. In Windows 2000, the Microsoft Windows Troubleshooting and Help System uses an ActiveX control that is named the Microsoft Local Troubleshooter (Tshoot.ocx). The Microsoft Windows Troubleshooting and Help System uses an ActiveX control that is named the Microsoft Local Troubleshooter (Tshoot.ocx). Microsoft Local Troubleshooter interacts with the local computer to help diagnose problems. This ActiveX control was designed to be used only by the Windows Troubleshooting and Help System.
What is wrong with the affected ActiveX controls?
The affected ActiveX control contain a buffer overrun. Because the control is marked "safe for scripting?" after installation, Internet Explorer, even in the Internet security zone, can load the control without any user interaction. By luring a user to view a specially-crafted Web page, an attacker could cause the control to fail in such a way that would allow arbitrary code to be run.
What are Internet Explorer security zones?
Internet Explorer security zones are a system that divides online content into categories or zones based on its trustworthiness. Specific Web domains can be assigned to a zone, depending on how much trust is placed in the content of each domain. The zone then restricts the capabilities of the Web content, based on the zone's settings.
By default, most Internet domains are treated as part of the Internet security zone, which has settings that prevent scripts and other active code from accessing resources on the local system. Conversely, the My Computer zone is a much less restricted zone which allows content to access and to make changes to content that is on the local system. By default, files that are stored on the local computer are run in the My Computer zone.
What could this vulnerability enable an attacker to do?
An attacker who successfully exploited this vulnerability could, in the worst case, run code of their choice on a user?s system. This would enable an attacker to take any action the legitimate user could take. This could include creating, modifying or deleting data. This could also include reconfiguring the system, or reformatting the hard disk.
How could an attacker exploit the vulnerability?
To exploit this vulnerability, the attacker would have to create a specially formed HTML-based e-mail and send it to the user. Alternatively an attacker would have to host a malicious Web site that contained a Web page designed to exploit this vulnerability.
Is there anything that helps mitigate the risk of an HTML email attack?
The risk of attack from the HTML email vector can be significantly reduced if the following conditions are met:
* You have applied the patch included with Microsoft Security bulletin MS03-040
* You are using Internet Explorer 6 or later
* You are using the Microsoft Outlook Email Security Update or Microsoft Outlook Express 6.0 and higher, or Microsoft Outlook 2000 or higher in their default configuration.
What does the patch do?
The patch helps remove the vulnerability by making sure that the ActiveX control validates all parameters correctly.
Microsoft thanks the following for working with us to protect customers:
* Greg Jones of KPMG UK and Cesar Cerrudo for reporting the issue described in MS03-042.
|
|
|
|
|
