Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2010.0210
Vulnerability in VBScript Could Allow Remote Code Execution
2 March 2010
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Internet Explorer
Publisher: Microsoft
Operating System: Windows 2000
Windows XP
Windows Server 2003
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Mitigation
CVE Names: CVE-2010-0483
Original Bulletin:
http://www.microsoft.com/technet/security/advisory/981169.mspx
- --------------------------BEGIN INCLUDED TEXT--------------------
Microsoft Security Advisory (981169)
Vulnerability in VBScript Could Allow Remote Code Execution
Published: March 01, 2010
Version: 1.0
General Information
Executive Summary
Microsoft is investigating new public reports of a vulnerability in VBScript
that is exposed on supported versions of Microsoft Windows 2000, Windows XP,
and Windows Server 2003 through the use of Internet Explorer. Our
investigation has shown that the vulnerability cannot be exploited on
Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008.
The main impact of the vulnerability is remote code execution. We are not
aware of attacks that try to use the reported vulnerabilities or of customer
impact at this time.
The vulnerability exists in the way that VBScript interacts with Windows Help
files when using Internet Explorer. If a malicious Web site displayed a
specially crafted dialog box and a user pressed the F1 key, arbitrary code
could be executed in the security context of the currently logged-on user.
On systems running Windows Server 2003, Internet Explorer Enhanced Security
Configuration is enabled by default, which helps to mitigate against this
issue.
We are actively working with partners in our Microsoft Active Protections
Program (MAPP) to provide information that they can use to provide broader
protections to customers.
Upon completion of this investigation, Microsoft will take the appropriate
action to help protect our customers. This may include providing a security
update through our monthly release process or providing an out-of-cycle
security update, depending on customer needs.
Microsoft is concerned that this new report of a vulnerability was not
responsibly disclosed, potentially putting computer users at risk. We
continue to encourage responsible disclosure of vulnerabilities. We believe
the commonly accepted practice of reporting vulnerabilities directly to a
vendor serves everyone's best interests. This practice helps to ensure that
customers receive comprehensive, high-quality updates for security
vulnerabilities without exposure to malicious attackers while the update
is being developed.
Affected Software
Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP
Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2, Windows Server 2003 with SP2 for
Itanium-based Systems, and Windows Server 2003 x64 Edition Service
Pack 2
Mitigating Factors
Mitigation refers to a setting, common configuration, or general
best-practice, existing in a default state, that could reduce the severity of
this issue. The following mitigating factors may be helpful in your
situation:
This vulnerability cannot be exploited on Windows 7, Windows Server 2008 R2,
Windows Vista, or Windows Server 2008.
The vulnerability requires user interaction. The vulnerability could not be
exploited without user interaction even if the user visited a malicious Web
site. Instead, an attacker would need to persuade a user to press the F1 key
on the keyboard while the Web site displays a scripted dialog box.
In a Web-based attack scenario, an attacker could host a Web site that
contains a Web page that is used to exploit this vulnerability. In addition,
compromised Web sites and Web sites that accept or host user-provided content
or advertisements could contain specially crafted content that could exploit
this vulnerability. In all cases, however, an attacker would have no way to
force users to visit these Web sites. Instead, an attacker would have to
convince users to visit the Web site, typically by getting them to click a
link in an e-mail message or Instant Messenger message that takes users to
the attackers Web site.
An attacker who successfully exploited this vulnerability could gain the
same user rights as the local user. Users whose accounts are configured to
have fewer user rights on the system could be less affected than users who
operate with administrative user rights.
By default, Internet Explorer on Windows Server 2003 runs in a restricted mode
that is known as Enhanced Security Configuration. This mode sets the security
level for the Internet zone to High. This is a mitigating factor for Web sites
that you have not added to the Internet Explorer Trusted sites zone.
By default, all supported versions of Microsoft Outlook, Microsoft Outlook
Express, and Windows Mail open HTML e-mail messages in the Restricted sites
zone, removing the risk of an attacker being able to use this vulnerability to
execute malicious code. The Restricted sites zone helps mitigate attacks that
could try to exploit this vulnerability by preventing Active Scripting and
ActiveX controls from being used when reading HTML e-mail messages. However,
if a user clicks a link in an e-mail message, the user could still be
vulnerable to exploitation of this vulnerability through the Web-based
attack scenario. Additionally, Outlook 2007 uses a different component to
render HTML e-mail, removing the risk of this exploit.
Workarounds
Workaround refers to a setting or configuration change that does not correct
the underlying issue but would help block known attack vectors before you
apply the update. Microsoft has tested the following workarounds and states
in the discussion whether a workaround reduces functionality:
o Do not press the F1 key when prompted by a Web site
Successful exploitation of this vulnerability requires that users assist
the exploit by pressing the F1 key on their keyboard. Our analysis shows
that if users do not press the F1 key on their keyboard, the vulnerability
cannot be exploited.
Consequently, malicious Web sites may attempt to persuade users into
pressing the F1 key. Such a Web site could invoke an endless loop of dialog
boxes that tell the user to press the F1 key to end the loop, or offer
information such as pricing information or help to be revealed through
the F1 key.
Users are advised to avoid pressing F1 presented by Web pages or other
Internet content. If a dialog box appears repeatedly in an attempt to
convince the user to press F1, users may log off the system or use Task
Manager to terminate the Internet Explorer process.
o Restrict access to the Windows Help System
Successful exploitation of this vulnerability requires that the Windows Help
System is functioning. You can help protect against exploitation of this
vulnerability if you modify the ACL on winhlp32.exe to be more restrictive
on Windows 2000, Windows XP and Windows Server 2003 by running the following
command from an administrative command line:
echo Y | cacls "%windir%\winhlp32.exe" /E /P everyone:N
Impact of workaround. The Windows Help System will be unavailable, and users
may not be able to invoke the help function in applications. The attempt to open
the help function in applications may lead to an error message.
How to undo the workaround:
Run the following command from an administrative command line:
echo Y | cacls "%windir%\winhlp32.exe" /E /R everyone
o Set Internet and Local intranet security zone settings to "High" to block
ActiveX Controls and Active Scripting in these zones
You can help protect against exploitation of this vulnerability by changing
your settings for the Internet security zone to prompt before running
ActiveX controls and Active Scripting. You can do this by setting your
browser security to High.
To raise the browsing security level in Internet Explorer, follow these
steps:
1. On the Internet Explorer Tools menu, click Internet Options.
2. In the Internet Options dialog box, click the Security tab, and then
click the Internet icon.
3. Under Security level for this zone, move the slider to High. This sets
the security level for all Web sites you visit to High.
Note: If no slider is visible, click Default Level, and then move the
slider to High.
Note: Setting the level to High may cause some Web sites to work
incorrectly. If you have difficulty using a Web site after you change this
setting, and you are sure the site is safe to use, you can add that site to
your list of trusted sites. This will allow the site to work correctly even
with the security setting set to High.
Impact of workaround. There are side effects to blocking ActiveX Controls and
Active Scripting. Many Web sites that are on the Internet or on an intranet
use ActiveX or Active Scripting to provide additional functionality. For
example, an online e-commerce site or banking site may use ActiveX Controls to
provide menus, ordering forms, or even account statements. Blocking ActiveX
Controls or Active Scripting is a global setting that affects all Internet and
intranet sites. If you do not want ActiveX Controls and Active Scripting to be
blocked for all these sites, use the steps outlined in "Add sites that you
trust to the Internet Explorer Trusted sites zone".
o Add sites that you trust to the Internet Explorer Trusted sites zone
After you set Internet Explorer to require a prompt before it runs
ActiveX controls and Active Scripting in the Internet zone and in the Local
intranet zone, you can add sites that you trust to the Internet Explorer
Trusted sites zone. This will allow you to continue to use trusted Web sites
exactly as you do today, while helping to protect you from this attack on
untrusted sites. We recommend that you add only sites that you trust to the
Trusted sites zone.
To do this, follow these steps:
1. In Internet Explorer, click Tools, click Internet Options, and then click
the Security tab.
2. In the Select a Web content zone to specify its current security settings
box, click Trusted Sites, and then click Sites.
3. If you want to add sites that do not require an encrypted channel, click
to clear the Require server verification (https:) for all sites in this
zone check box.
4. In the Add this Web site to the zone box, type the URL of a site that you
trust, and then click Add.
5. Repeat these steps for each site that you want to add to the zone.
6. Click OK two times to accept the changes and return to Internet
Explorer.
Note: Add any sites that you trust not to take malicious action on your
system. Two in particular that you may want to add are
*.windowsupdate.microsoft.com and *.update.microsoft.com. These are the
sites that will host the update, and it requires an ActiveX Control to
install the update.
o Configure Internet Explorer to prompt before running Active Scripting or to
disable Active Scripting in the Internet and Local intranet security zone
You can help protect against exploitation of this vulnerability by changing
your settings to prompt before running Active Scripting or to disable
Active Scripting in the Internet and Local intranet security zone. To do
this, follow these steps:
1. In Internet Explorer, click Internet Options on the Tools menu.
2. Click the Security tab.
3. Click Internet, and then click Custom Level.
4. Under Settings, in the Scripting section, under Active Scripting,
click Prompt or Disable, and then click OK.
5. Click Local intranet, and then click Custom Level.
6. Under Settings, in the Scripting section, under Active Scripting,
click Prompt or Disable, and then click OK.
7. Click OK two times to return to Internet Explorer.
Note: Disabling Active Scripting in the Internet and Local intranet
security zones may cause some Web sites to work incorrectly. If you have
difficulty using a Web site after you change this setting, and you are sure
the site is safe to use, you can add that site to your list of trusted sites.
This will allow the site to work correctly.
Impact of workaround. There are side effects to prompting before running
Active Scripting. Many Web sites that are on the Internet or on an intranet
use Active Scripting to provide additional functionality. For example, an
online e-commerce site or banking site may use Active Scripting to provide
menus, ordering forms, or even account statements. Prompting before running
Active Scripting is a global setting that affects all Internet and intranet
sites. You will be prompted frequently when you enable this workaround. For
each prompt, if you feel you trust the site that you are visiting, click Yes
to run Active Scripting. If you do not want to be prompted for all these sites,
use the steps outlined in "Add sites that you trust to the Internet Explorer
Trusted sites zone".
o Add sites that you trust to the Internet Explorer Trusted sites zone
After you set Internet Explorer to require a prompt before it runs ActiveX
controls and Active Scripting in the Internet zone and in the Local intranet
zone, you can add sites that you trust to the Internet Explorer Trusted
sites zone. This will allow you to continue to use trusted Web sites exactly
as you do today, while helping to protect you from this attack on untrusted
sites. We recommend that you add only sites that you trust to the Trusted
sites zone.
To do this, follow these steps:
1. In Internet Explorer, click Tools, click Internet Options, and then
click the Security tab.
2. In the Select a Web content zone to specify its current security settings
box, click Trusted Sites, and then click Sites.
3. If you want to add sites that do not require an encrypted channel, click
to clear the Require server verification (https:) for all sites in this
zone check box.
4. In the Add this Web site to the zone box, type the URL of a site that you
trust, and then click Add.
5. Repeat these steps for each site that you want to add to the zone.
6. Click OK two times to accept the changes and return to Internet
Explorer.
Note: Add any sites that you trust not to take malicious action on your
system. Two in particular that you may want to add are
*.windowsupdate.microsoft.com and *.update.microsoft.com. These are the
sites that will host the update, and it requires an ActiveX Control to
install the update.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFLjFTH/iFOrG6YcBERArlkAJ9w2wzINw3V0l4Ik9poQ5RxWkyMrgCfXPTn
TUjknWCjSR/a0EIbt0/lw00=
=neIz
-----END PGP SIGNATURE-----