CERT-In Vulnerability Note
CIVN-2007-0092
Microsoft Windows URI Handling Command Execution Vulnerability
Original Issue Date:July 31, 2007
Updated: May 22, 2010
Severity Rating: HIGH
Systems Affected
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
Overview
A vulnerability has been reported in Microsoft Windows that could be exploited by an attacker to take complete control of the vulnerable system.
Description
A Uniform Resource Identifier URI is a string of characters that can be used to identify a location, resource, or protocol. Microsoft Windows parses a URI to determine the appropriate application that is registered to handle the protocol. Several web browsers such as Firefox and email clients may rely on Microsoft Windows to determine the proper application to handle a specified URI.
The vulnerability is caused due to insufficient input validation while handling system default URIs with registered URI handlers e.g. "mailto", "news", "nntp", "snews", "telnet" .
Internet Explorer 7 has changed how Microsoft Windows parses URIs. This has introduced a flaw that can cause Windows to incorrectly determine the appropriate handler for the protocol specified in a URI. This flaw appears to rely on having a " " character in the URI.
The attacker could exploit this vulnerability by creating and hosting a specially crafted website and persuading user to visit such website through a browser such as Firefox with a specially crafted URI handler containing character and ends with certain extension e.g. ".bat", ".cmd" . Successful exploitation allows attacker to execute arbitrary code.
Note: Public reports demonstrate that Mozilla Firefox can be used to pass malicious URIs to Windows, but other applications may also act as attack vectors for this vulnerability.
Workaround
Block mailto: 00, nntp: 00, news: 00, snews: 00, telnet: 00 strings inside of HTML pages or other network streams using an application layer firewall or IPS.
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS07-061
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/advisory/943521.mspx
References
Microsoft
http://www.microsoft.com/technet/security/advisory/943521.mspx
xs-sniper
http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005/
Secunia
http://secunia.com/advisories/26201/
USCERT
http://www.kb.cert.org/vuls/id/783400
http://www.kb.cert.org/vuls/id/403150
CVE Name
CVE-2007-3896
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|