Microsoft Internet Explorer HTML Help file code execution
| ie-html-helpfile-execute (4601) |  High Risk |
Description:
Internet Explorer allows compiled HTML Help files (*.chm) to launch programs from a shortcut in the Help file. A malicious Web site could reference an HTML Help file that includes malicious code and possibly execute code on a visiting user's computer without the knowledge or consent of the user.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS02-055. See References.
Note: Microsoft originally provided a patch for this vulnerability in MS00-037, but it was superseded by the patch released with MS02-055.
References:
- BugTraq Mailing List, Mon Nov 20 2000 - 10:50:46 CST: IE 5.x/Outlook allows executing arbitrary programs using .chm files and temporary internet files folder.
- BugTraq Mailing List, Wed Mar 01 2000 - 09:32:06 CST: IE 5.x allows executing arbitrary programs using .chm files.
- CERT Advisory CA-2000-12: HHCtrl ActiveX Control Allows Local Files to be Executed.
- Microsoft Knowledge Base Article 259166: UNC Path Can Be Used to Start Programs by Using .chm Files.
- Microsoft Security Bulletin MS00-037: Patch Available for 'HTML Help File Code Execution' Vulnerability.
- Microsoft Security Bulletin MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (Q323255).
- BID-1033: MS IE HTML Help Shortcut Vulnerability
- CVE-2000-0201: The window.showHelp() method in Internet Explorer 5.x does not restrict HTML help files (.chm) to be executed from the local host, which allows remote attackers to execute arbitrary commands via Microsoft Networking.
- OSVDB ID: 14793: Microsoft IE window.showHelp() HTML Help File Arbitrary Command Execution
- US-CERT VU#25249: HHControl Object (showHelp) may execute shortcuts embedded in help files
Platforms Affected:
- Microsoft Internet Explorer 4.0
- Microsoft Internet Explorer 4.0.1
- Microsoft Internet Explorer 5.0
- Microsoft Internet Explorer 5.01
Reported:
Mar 01, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this