-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2003.0124 -- Microsoft Security Bulletin MS03-006
  Flaw in Windows Me Help and Support Center Could Enable Code Execution
                                 (812709)
                             27 February 2003

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Windows Me
Vendor:                 Microsoft
Operating System:       Windows Me
Impact:                 Execute Arbitrary Code/Commands
Access Required:        Remote

Comment: CVE Id: CAN-2003-0009

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------
Title:      Flaw in Windows Me Help and Support Center Could 
            Enable Code Execution (812709)
Date:       26 February, 2003
Software:   Microsoft Windows Me
Impact:     Run Code of Attacker's Choice 
Max Risk:   Critical
Bulletin:   MS03-006

Microsoft encourages customers to review the Security Bulletins 
at: 
http://www.microsoft.com/technet/security/bulletin/MS03-006.asp
http://www.microsoft.com/security/security_bulletins/ms03-006.asp
- - -----------------------------------------------------------------

Issue:
======
Help and Support Center provides a centralized facility through 
which users can obtain assistance on a variety of topics. For 
instance, it provides product documentation, assistance in 
determining hardware compatibility, access to Windows Update, 
online help from Microsoft, and other assistance. Users and 
programs can execute URL links to Help and Support Center by 
using the "hcp://" prefix in a URL link instead of "http://".

A security vulnerability is present in the Windows Me version of 
Help and Support Center, and results because the URL Handler for 
the "hcp://" prefix contains an unchecked buffer.

An attacker could exploit the vulnerability by constructing a URL 
that,when clicked on by the user, would execute code of the 
attacker's choice in the Local Computer security context. The URL 
could be hosted on a web page, or sent directly to the user in 
email. In the web based scenario, where a user then clicked on 
the URL hosted on a website, an attacker could have the ability 
to read or launch files already present on the local machine. In 
the case of an e-mail borne attack, if the user was using Outlook 
Express 6.0 or Outlook 2002 in their default configurations, or 
Outlook 98 or 2000 in conjunction with the Outlook Email Security 
Update, then an attack could not be automated and the user would 
still need to click on a URL sent in e-mail. However if the user 
was not using Outlook Express 6.0 or Outlook 2002 in their 
default configurations, or Outlook 98 or 2000 in conjunction with 
the Outlook Email Security Update, the attacker could cause an 
attack to trigger automatically without the user having to click 
on a URL contained in an e-mail. 

Mitigating Factors:
====================
 - The Help and Support Center function could not be started 
automatically in Outlook Express or Outlook if the user is 
running Internet Explorer 6.0 Service Pack 1. 
 - For an attack to be successful, the user would need to visit a 
website under the attacker's control or receive an HTML e-mail 
from the attacker. 
 - Automatic exploitation of the vulnerability by an HTML email 
would be blocked by Outlook Express 6.0 and Outlook 2002 in their 
default configurations, and by Outlook 98 and 2000 if used in 
conjunction with the Outlook Email Security Update.

Risk Rating:
============
 - Critical

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read 
the Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-006.asp
http://www.microsoft.com/security/security_bulletins/ms03-006.asp

for information on obtaining this patch.


- - -----------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT 
DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING 
THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 
PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS 
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, 
INCIDENTAL, CONSEQUENTIAL,LOSS OF BUSINESS PROFITS OR SPECIAL 
DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN 
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT 
ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL 
OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPl0MJo0ZSRQxA/UrAQGXswgAg+ZZ1oCiFD6ktITFi7Q3Oc44txdU927I
MRwZq6y6HHAD+hjcAbDyT5X9Djc36tYEB5CaDbq/qCWgSUJa6qopf11PCuxd9XS7
7XoI73ofAoVSnRB9x9wknRAoTRtffNwmyW8ILuVVCK3y0JP+ThgYS6DinY9OCY5Q
Fa7X4aojh5kwV5nQt4cyPKk7C9arVLJ0ww6c66J8XdF+/p7kILItrSqsqUDe1gz1
ES4ib7MnAnGPNlB/elSRuDYU4YkgBEEVgC5od28VcaBAq+GHn4KEYWDkpRNQozQj
azo+D8/Y+v3zdFau9oTrqV6MgKR2yULCeKQidcOrU2QLxmWW5cw/bA==
=jA6C
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBPl3+Eih9+71yA2DNAQH/WgP+PwcQk1nFzBYKlIf5EczlyPBC9YX5RVAd
MpS2S9axF9bT/1ie5jeo9YEnBTq3PX+80/E/Gsq9R5sQqZ0oLy9qNnt6ZpqC4UHr
XGdpDqNEmvfaSinxdmdeNYkNvB1522pq1AUChonh8Vy+ccyYWASYVYHlLdjkCeru
EoFQ2Dfgbnw=
=WuVl
-----END PGP SIGNATURE-----