Signature Detail

SMTP: Microsoft Help Center Input Validation Vulnerability

This signature detects e-mail containing invalid HTTP links to the Microsoft Help Center. Attackers can exploit a known input validation vulnerability in Help and Support Center, by sending a victim a specially formatted HSC URL in an e-mail. This vulnerability affects Windows XP prior to service pack 2, and the Windows 2003 Server.

Extended Description

A security vulnerability has been reported in Microsoft Windows XP and Server 2003 operating systems. This issue exists in the Help and Support Center (HSC) and is due to how the feature handles HCP invocation URIs for DVD driver upgrades. This issue could be exploited from a malicious web page or HTML e-mail to cause a malicious executable to be run on a vulnerable system. This would occur in the context of the victim user, though it has been reported that significant user interaction is required for exploitation to occur. While this issue may be exploited through Internet Explorer, it should also be noted that third-party web client software could also invoke HSC via a HCP URI.

Affected Products

• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium
• Microsoft Windows Server 2003 Standard Edition
• Microsoft Windows Server 2003 Web Edition
• Microsoft Windows XP 64-bit Edition SP1
• Microsoft Windows XP 64-bit Edition
• Microsoft Windows XP 64-bit Edition Version 2003 SP1
• Microsoft Windows XP 64-bit Edition Version 2003
• Microsoft Windows XP Gold
• Microsoft Windows XP Home SP1
• Microsoft Windows XP Home
• Microsoft Windows XP Professional SP1
• Microsoft Windows XP Professional

References

• BugTraq: 10321
• CVE: CVE-2004-0199
• URL: http://www.microsoft.com/technet/security/bulletin/ms04-015.mspx
• URL: http://www.kb.cert.org/vuls/id/484814