CERT-In Vulnerability Note
CIVN-2005-0099
Microsoft Windows Shell and WebView Remote Code Execution Vulnerabilities
Original Issue Date:October 12, 2005
Severity Rating: HIGH
Systems Affected
Microsoft Windows 2000 Service Pack 4 Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems Microsoft Windows Server 2003 x64 Edition
Overview
Multiple vulnerabilities has been identified in Microsoft Windows, which could be exploited remotely by malicious users to compromise a system.
Description
Three vulnerabilities reported in Microsoft Windows which allow remote exploitation.
1 A remote code execution vulnerability exists in Microsoft Windows due to an error in handling of properties associated with .lnk files. To exploit this vulnerability an attacker must be able to log on to the specific system that is targeted for attack or persuade a user to open a .lnk file that has specially crafted properties.
2 Microsoft Windows is also vulnerable to another remote code execution error due to an unchecked buffer in the handling of properties associated with a ".lnk" file. To exploit this vulnerability an attacker must be able to log on to the specific system that is targeted for attack or persuade a user to view properties or open a .lnk file that has specially crafted properties.
3 The third vulnerability is due to an error in the way that WebView in Windows Explorer handles certain HTML characters in preview fields. To exploit this vulnerability a user must be convinced to preview a malicious file.
Workaround
Microsoft suggested following workarounds to mitigate the attack vectors. - For first vulnerability:
Do not open files that have .lnk extensions and that come from unknown or untrusted sources
- For second vulnerbility:
Do not view the properties of files that have .lnk file name extensions and that come from unknown or untrusted sources.
- For third vulnerability:
Disable Web View
or
Use the Group Policy settings to disable Web View on all affected systems that do not require this feature
or
Block TCP ports 139 and 445 at the perimeter firewall:
Solution
Apply appropriate security update as mentioned in the Microsoft Security Bulletin
MS05-049
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/Bulletin/MS05-049.mspx
References
Secunia Advisory:SA17168
http://secunia.com/advisories/17168/
CVE Name
CAN-2005-2122
CAN-2005-2118
CAN-2005-2117
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|