Microsoft Internet Explorer showHelp directory traversal
| ie-showhelp-directory-traversal (14105) |  Medium Risk |
Description:
Microsoft Internet Explorer could allow a remote attacker to execute files on a vulnerable system, caused by a directory traversal vulnerability in the Windows showHelp method. A remote attacker could exploit this vulnerability by creating a malicious Web page that invokes the showHelp method, which would allow the attacker to execute known compiled help files (chm files) in the Local Computer security zone, once the page is viewed.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS05-026. See References.
Note: Microsoft originally provided a patch for this vulnerability inMS04-023, but it was superseded by the patch released with MS05-026.
References:
- BugTraq Mailing List, Mon Dec 29 2003 - 21:57:49 CST : IE 5.x-6.0 allows executing arbitrary programs using showHelp().
- CIAC Information Bulletin 0-182: Microsoft Vulnerability in HTML Help Could Allow Code Execution.
- Microsoft Security Bulletin MS04-023: Vulnerability in HTML Help Could Allow Code Execution (840315).
- Microsoft Security Bulletin MS05-026: Vulnerability in HTML Help Could Allow Remote Code Execution (896358).
- BID-9320: Microsoft Windows showHelp CHM File Execution Weakness
- CVE-2003-1041: Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing .. (dot dot) sequences and a filename that ends in :: which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.
- US-CERT VU#187196: Microsoft Windows fails to properly process showHelp URLs
Platforms Affected:
- Microsoft Internet Explorer 5.0
- Microsoft Internet Explorer 5.0.1 SP2
- Microsoft Internet Explorer 5.0.1 SP1
- Microsoft Internet Explorer 5.0.1
- Microsoft Internet Explorer 5.0.1 SP3
- Microsoft Internet Explorer 5.0.1 SP4
- Microsoft Internet Explorer 5.1
- Microsoft Internet Explorer 5.5 SP2
- Microsoft Internet Explorer 5.5
- Microsoft Internet Explorer 5.5 SP1
- Microsoft Internet Explorer 5.5 Preview
- Microsoft Internet Explorer 6.0
Reported:
Dec 30, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net