1. /
  2. Security Response/
  3. Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability

Microsoft Windows HSC DVD Driver Upgrade Code Execution Vulnerability

Risk

Medium

Date Discovered

May 11, 2004

Description

A security vulnerability has been reported in Microsoft Windows XP and Server 2003 operating systems. This issue exists in the Help and Support Center (HSC) and is due to how the feature handles HCP invocation URIs for DVD driver upgrades. This issue could be exploited from a malicious web page or HTML e-mail to cause a malicious executable to be run on a vulnerable system. This would occur in the context of the victim user, though it has been reported that significant user interaction is required for exploitation to occur. While this issue may be exploited through Internet Explorer, it should also be noted that third-party web client software could also invoke HSC via a HCP URI.

Technologies Affected

  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows Server 2003 Datacenter Edition Itanium
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Enterprise Edition Itanium
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows XP 64-bit Edition
  • Microsoft Windows XP 64-bit Edition SP1
  • Microsoft Windows XP 64-bit Edition Version 2003
  • Microsoft Windows XP 64-bit Edition Version 2003 SP1
  • Microsoft Windows XP Home
  • Microsoft Windows XP Home SP1
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional SP1

Recommendations

Run all software as a nonprivileged user with minimal access rights.

All non-administrative tasks such as reading e-mail and browsing the web should be performed as an unprivileged user with minimal access rights. This will reduce the consequences of successful exploitation.

Do not follow links provided by unknown or untrusted sources.

This issue may be exploited from a malicious web page. Users should be wary of visiting websites of questionable integrity or following links provided by unfamiliar or suspicious sources.

Do not accept communications that originate from unknown or untrusted sources.

This issue may potentially be exploited via HTML e-mail. Disabling support for HTML e-mail in the mail client may limit exposure to this attack vector. HTML e-mail may also be filtered using other means.
Microsoft has released fixes to address this issue.

Credits

Discovery is credited to Donnie Werner.
Copyright © Symantec Corporation.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.

Threat Intelligence

Subscribe
Follow the Threat Intelligence Twitter feed
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver