MS03-014 Cumulative Patch for Outlook Express

[Steven]

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------

Title: Cumulative Patch for Outlook Express (330994)

Date: 23 April 2003

Software: Microsoft © Outlook Express

Impact: Run code of the attacker's choice on a user's machine.

Max Risk: Critical

Bulletin: MS03-014

Microsoft encourages customers to review the Security Bulletins at:

http://www.microsoft.com/technet/security/...in/MS03-014.asp

http://www.microsoft.com/security/security...ns/ms03-014.asp

- ----------------------------------------------------------------------

Issue:

======

MHTML stands for MIME Encapsulation of Aggregate HTML. MHTML is an

Internet standard that defines the MIME (Multipurpose Internet Mail

Extensions) structure used to send HTML content in e-mail message

bodies. The MHTML URL Handler in Windows is part of Outlook Express

and provides a URL type that can be used on the local machine. This

URL type (MHTML://) allows MHTML documents to be launched from a

command line, from Start/Run, using Windows Explorer or from within

Internet Explorer.

A vulnerability exists in the MHTML URL Handler that allows any

file that can be rendered as text to be opened and rendered as part

of a page in Internet Explorer. As a result, it would be possible

to construct a URL that referred to a text file that was stored on

the local computer and have that file render as HTML. If the text

file contained script, that script would execute when the file was

accessed. Since the file would reside on the local computer, it

would be rendered in the Local Computer Security Zone. Files that

are opened within the Local Computer Zone are subject to fewer

restrictions than files opened in other security zones.

Using this method, an attacker could attempt to construct a URL and

either host it on a website or send it via email. In the web based

scenario, where a user then clicked on a URL hosted on a website,

an attacker could have the ability to read or launch files already

present on the local machine. In the case of an e-mail borne attack,

if the user was using Outlook Express 6.0 or Outlook 2002 in their

default configurations, or Outlook 98 or 2000 in conjunction with

the Outlook Email Security Update, then an attack could not be

automated and the user would still need to click on a URL sent in

the e-mail. However if the user was not using Outlook Express 6.0

or Outlook 2002 in their default configurations, or Outlook 98 or

2000 in conjunction with the Outlook Email Security Update, the

attacker could cause an attack to trigger automatically without the

user having to click on a URL contained in an e-mail. In both the

web based and e-mail based cases, any limitations on the user's

privileges would also restrict the capabilities of the attacker's

script.

Applying the update listed in Microsoft Security Bulletin MS03-004

- -- Cumulative Patch for Internet Explorer-will help block an

attacker from being able to load a file onto a user's computer and

prevent the passing of parameters to an executable. This means that

an attacker could only launch a program that already existed on the

computer-provided the attacker was aware of the location of the

program-and would not be able to pass parameters to the program for

it to execute.

MHTML is a standard for exchanging HTML content in e-mail and as a

result the MHTML URL Handler function has been implemented in

Outlook Express. Internet Explorer can also render MHTML content,

however the MHTML function has not been implemented separately in

Internet Explorer - it simply uses Outlook Express to render the

MHTML content.

Mitigating Factors:

====================

- -For the web-based scenario, the attacker would have to host a web

site that contained a web page used to exploit this vulnerability

and entice a user to visit it. An attacker would have no way to

force a user to visit the site. Instead, the attacker would need to

lure the user there, typically by getting the user to click on a

link to the attacker's site.

- -The HTML mail-based attack scenario would be blocked by Outlook

Express 6.0 and Outlook 2002 in their default configurations, and

by Outlook 98 and 2000 if used in conjunction with the Outlook

Email Security Update.

- -Exploiting the vulnerability would allow the attacker only the

same privileges as the user. Users whose accounts are configured to

have few privileges on the system would be at less risk than ones

who operate with administrative privileges.

- -If the cumulative patch for Internet Explorer MS03-004 has been

installed, known means by which an attacker may place a file onto a

user's computer will be blocked.

- -In order to invoke an executable already present on the local

system, an attacker must know the path to that executable.

Risk Rating:

============

- Critical

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read the

Security Bulletins at

http://www.microsoft.com/technet/security/...in/ms03-014.asp

http://www.microsoft.com/security/security...ns/ms03-014.asp

for information on obtaining this patch.

- ---------------------------------------------------------------------

Edited April 25, 2003 by xStainDx

[Sierra]

nice patch!