Microsoft Windows HTML Application Host command execution
| windows-htmlapphost-command-execution (19835) |  High Risk |
Description:
Microsoft Windows could allow a remote attacker to execute arbitrary commands caused by a vulnerability in the Windows Shell. A remote attacker could create a specially-crafted document to launch the HTML Application Host application and execute arbitrary commands on the system with the privileges of the victim, once the victim opens the document.
Platforms Affected:
- Microsoft, Windows 2000 SP3
- Microsoft, Windows 2000 SP4
- Microsoft, Windows 2003 Server Itanium
- Microsoft, Windows 2003 Server
- Microsoft, Windows 98
- Microsoft, Windows 98SE
- Microsoft, Windows Me
- Microsoft, Windows XP 2003 64-bit Itanium
- Microsoft, Windows XP SP1
- Microsoft, Windows XP SP2
- Microsoft, Windows XP SP1 64-bit Itanium
Remedy:
Apply the appropriate patch for your system, as listed in the Microsoft Security Bulletin MS05-016. See References.
For Windows 2000, Windows XP and Windows Server 2003:
Apply the appropriate patches for your system, as listed in Microsoft Security Bulletin MS05-049. See References.
Note: Microsoft originally provided a patch for this vulnerability in MS05-016, but it was superseded by the patch released with MS05-049. Microsoft is also reporting that MS05-016 was superseded by MS06-015. Microsoft is reporting that MS05-016 was also superseded by MS06-045. See References.
For Windows XP SP1:
Microsoft originally provided a patch for this vulnerability in Microsoft Security Bulletin MS03-045, but it has been superseded by the patch released with Microsoft Security Bulletin MS05-057. See References.
For Windows XP SP2 and Windows Server 2003:
Note: Microsoft originally provided a patch for this vulnerability in MS06-016, but it was superseded by the patch released with MS05-049. Microsoft is also reporting that MS05-016 was superseded by MS06-015. Microsoft is reporting that MS05-016 was also superseded by MS06-045. MS06-045 has been superseded by MS07-006. See References.
Consequences:
Gain Access
References:
- CIAC INFORMATION BULLETIN P-179, Vulnerability in Windows Shell (893086) at http://www.ciac.org/ciac/bulletins/p-179.shtml.
- Microsoft Security Bulletin MS05-016, Vulnerability in Windows Shell that Could Allow Remote Code Execution (893086) at http://www.microsoft.com/technet/security/Bulletin/MS05-016.mspx.
- Microsoft Security Bulletin MS05-049, Vulnerabilities in Windows Shell Could Allow Remote Code Execution (900725) at http://www.microsoft.com/technet/security/bulletin/ms05-049.mspx.
- Microsoft Security Bulletin MS06-015, Vulnerability in Windows Explorer Could Allow Remote Code Execution (908531) at http://www.microsoft.com/technet/security/Bulletin/MS06-015.mspx.
- Microsoft Security Bulletin MS06-045, Vulnerability in Windows Explorer Could Allow Remote Code Execution (921398) at http://www.microsoft.com/technet/security/bulletin/ms06-045.mspx.
- Microsoft Security Bulletin MS06-057, Vulnerability in Windows Explorer Could Allow Remote Execution (923191) at http://www.microsoft.com/technet/security/bulletin/ms06-057.mspx.
- Microsoft Security Bulletin MS07-006, Vulnerability in Windows Shell Could Allow Elevation of Privilege (928255) at http://www.microsoft.com/technet/security/Bulletin/MS07-006.mspx.
- BID-13132: Microsoft Windows Shell Remote Code Execution Vulnerability
- CVE-2005-0063: The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
- US-CERT VU#673051: Microsoft Windows opens OLE2 documents using a program specified internally by the document
- VUPEN/ADV-2005-0335: Microsoft Windows Shell Code Execution Vulnerability (MS05-016)
Reported:
Apr 12, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net