Microsoft Windows Hyperlink Object Library code execution
| win-hyperlink-code-execution (19110) |  Medium Risk |
Description:
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by improper bounds checking in the Hyperlink Object Library when handling hyperlinks. By creating a malicious hyperlink, a remote attacker could execute arbitrary code on the system, once the link is clicked. An attacker could exploit this vulnerability by sending the malicious hyperlink to a victim in an email or by hosting it on a Web page.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS05-015. See References.
For Windows 2000, Windows XP Service Pack 1and Windows XP Service Pack 2, Windows Server 2003, and Windows Server 2003 Service Pack 1:
Microsoft originally provided a patch for this vulnerability in MS05-015, but it was superseded by the patch released with MS06-050. See References.
References:
- CIAC Information Bulletin P-124: Microsoft Vulnerability in Hyperlink Object Library.
- Microsoft Security Bulletin MS05-015: Vulnerability in Hyperlink Object Library Could Allow Remote Code Execution (888113).
- Microsoft Security Bulletin MS06-050: Vulnerabilities in Microsoft Windows Hyperlink Object Library Could Allow Remote Code Execution (920670).
- BID-12479: Microsoft Windows Hyperlink Object Library Buffer Overflow Vulnerability
- CVE-2005-0057: The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an unchecked buffer in the library, possibly due to a buffer overflow.
- SA14195: Microsoft Windows Hyperlink Object Library Buffer Overflow
- SECTRACK ID: 1013119: Microsoft Windows Hyperlink Object Library Lets Remote Users Execute Arbitrary Code
- US-CERT VU#820427: Microsoft Hyperlink Object Library buffer overflow
Platforms Affected:
- Microsoft Windows 2000 SP4
- Microsoft Windows 2000 SP3
- Microsoft Windows 2003 Server
- Microsoft Windows 2003 Server Itanium
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows Me
- Microsoft Windows XP 2003 x64 Itanium
- Microsoft Windows XP SP1
- Microsoft Windows XP SP2
- Microsoft Windows XP SP1 x64 Itanium
Reported:
Feb 08, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net