CERT-In Vulnerability Note
CIVN-2004-0069
Microsoft HyperTerminal Buffer Overflow Vulnerability
Original Issue Date:December 15, 2004
Severity Rating: MEDIUM
Systems Affected
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server
- Microsoft Windows NT 4.0 Server
- Microsoft Windows NT 4.0 Server, Terminal Server Edition
- Microsoft Windows Server 2003 Datacenter Edition
- Microsoft Windows Server 2003 Enterprise Edition
- Microsoft Windows Server 2003 Standard Edition
- Microsoft Windows Server 2003 Web Edition
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Professional
Overview
The Microsoft HyperTerminal contains a vulnerability that may allow an attacker to gain complete control of an affected system. An attacker could exploit this vulnerability by constructing a malicious HyperTerminal session file that allows remote code execution on the system.
Impact
Successful exploitation of the vulnerability allows execution of arbitrary code.
Description
A vulnerability has been reported in Microsoft HyperTerminal, which could be exploited by a remote attacker by constructing a malicious HyperTerminal session file that could potentially allow remote code execution if HyperTerminal has been set as the default telnet client.
This vulnerability is caused due to boundary errors in the handling of HyperTerminal session files and telnet URLs. This could be used by an attacker to cause a buffer overflow by tricking a user into opening a malicious HyperTerminal session file and execute an arbitrary code on the affected system.
Workaround
- Do not open or save HyperTerminal Session files .ht files received from untrusted sources.
- Prevent e-mail attacks by blocking HyperTerminal session files .ht files at mail gateway & mail client levels.
- Disable the handler for HyperTerminal session files .ht files by removing the following key:
HKEY_CLASSES_ROOT\htfile
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS04-043
Vendor Information
Microsoft Security Bulletin MS04-043
http://www.microsoft.com/technet/security/bulletin/ms04-043.mspx
References
Secunia Advisory:SA13466
http://secunia.com/advisories/13464/
Securitytracker advisory
http://securitytracker.com/alerts/2004/Dec/1012518.html
CVE Name
CAN-2004-0568
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|