Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:13792
HistoryAug 08, 2006 - 12:00 a.m.

Microsoft Security Bulletin MS06-043 Vulnerability in Microsoft Windows Could Allow Remote Code Execution (920214)

2006-08-0800:00:00
vulners.com
9

Microsoft Security Bulletin MS06-043
Vulnerability in Microsoft Windows Could Allow Remote Code Execution (920214)
Published: August 8, 2006

Version: 1.0
Summary

Who Should Read this Document: Customers who use Microsoft Windows

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately

Security Update Replacement: None

Caveats: None

Tested Software and Security Update Download Locations:

Affected Software:

Microsoft Windows XP Service Pack 2

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 Service Pack 1

Microsoft Windows Server 2003 with SP1 for Itanium-based Systems

Microsoft Windows Server 2003 x64 Edition

Tested Microsoft Windows Components:

Affected Components:

Outlook Express 6 on Microsoft Windows XP Service Pack 2 - Download the update

Outlook Express 6 on Microsoft Windows XP Professional x64 Edition - Download the update

Outlook Express 6 on Microsoft Windows Server 2003 Service Pack 1 - Download the update

Outlook Express 6 on Microsoft Windows Server 2003 with SP1 for Itanium-based Systems - Download the update

Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition - Download the update

Non-Affected Software:

Microsoft Windows 2000 Service Pack 4

Microsoft Windows XP Service Pack 1

Microsoft Windows Server 2003

Microsoft Windows Server 2003 for Itanium-based Systems

The software in this list has been tested to determine whether the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support life cycle for your product and version, visit the Microsoft Support Lifecycle Web site.

Note The security updates for Microsoft Windows Server 2003 Service Pack 1 and Windows Server 2003 x64 Edition also apply to Windows Server 2003 R2.
Top of sectionTop of section
General Information

Executive Summary

Executive Summary:

This update resolves a newly-discovered, publicly-reported vulnerability. The vulnerability is documented in the "Vulnerability Details" section of this bulletin

An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

We recommend that customers apply the update immediately.

Severity Ratings and Vulnerability Identifiers:
Vulnerability Identifiers Impact of Vulnerability Outlook Express 6 on Windows XP Service Pack 2 (including the 64-bit Edition) Outlook Express 6 on Windows Server 2003 Service Pack 1 (including the 64-bit Edition)

MHTML Parsing Vulnerability - CVE-2006-2766

Remote Code Execution

Critical

Critical

This assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Note The severity ratings for non-x86 operating system versions map to the x86 operating systems versions as follows:

The Windows XP Professional x64 Edition severity rating is the same as the Windows XP Service Pack 2 severity rating.

The Windows Server 2003 with SP1 for Itanium-based Systems severity rating is the same as the Windows Server 2003 Service Pack 1 severity rating.

The Windows Server 2003 x64 Edition severity rating is the same as the Windows Server 2003 Service Pack 1 severity rating.
Top of sectionTop of section

Frequently Asked Questions (FAQ) Related to This Security Update

Extended security update support for Windows 98, Windows 98 Second Edition, or Windows Millennium Edition ended on July 11, 2006. I am still using one of these operating systems, what should I do?
Windows 98, Windows 98 Second Edition, or Windows Millennium Edition has reached the end of their life cycles. It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Support Lifecycle, visit the following Microsoft Support Lifecycle Web site. For more information about the extended security update support period for these operating system versions, visit the Microsoft Product Support Services Web site.

Extended security update support for Microsoft Windows NT Workstation 4.0 Service Pack 6a and Windows 2000 Service Pack 2 ended on June 30, 2004. Extended security update support for Microsoft Windows NT Server 4.0 Service Pack 6a ended on December 31, 2004. Extended security update support for Microsoft Windows 2000 Service Pack 3 ended on June 30, 2005. I am still using one of these operating systems, what should I do?
Windows NT Workstation 4.0 Service Pack 6a, Windows NT Server 4.0 Service Pack 6a, Windows 2000 Service Pack 2, and Windows 2000 Service Pack 3 have reached the end of their life cycles. It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Support Lifecycle, visit the following Microsoft Support Lifecycle Web site. For more information about the extended security update support period for these operating system versions, visit the Microsoft Product Support Services Web site.

Customers who require custom support for these products must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, visit the Microsoft Worldwide Information Web site, select the country, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Windows Operating System Product Support Lifecycle FAQ.

Can I use the Microsoft Baseline Security Analyzer (MBSA) to determine whether this update is required?
The following table provides the MBSA detection summary for this security update.
Product MBSA 1.2.1 Enterprise Update Scan Tool (EST) MBSA 2.0

Outlook Express 6 on Windows XP Service Pack 2

No

Yes

Yes

Outlook Express 6 on Microsoft Windows XP Professional x64 Edition

No

No

Yes

Outlook Express 6 on Microsoft Windows Server 2003 Service Pack 1

No

Yes

Yes

Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition

No

No

Yes

Outlook Express 6 on Microsoft Windows Server 2003 with SP1 for Itanium-based Systems

No

No

Yes

For more information about MBSA, visit the MBSA Web site. For more information about the programs that Microsoft Update and MBSA 2.0 currently do not detect, see Microsoft Knowledge Base Article 895660

What is the Enterprise Update Scan Tool (EST)?
As part of an ongoing commitment to provide detection tools for bulletin-class security updates, Microsoft delivers a stand-alone detection tool whenever the Microsoft Baseline Security Analyzer (MBSA) and the Office Detection Tool (ODT) cannot detect whether the update is required for an MSRC release cycle. This stand-alone tool is called the Enterprise Update Scan Tool (EST) and is designed for enterprise administrators. When a version of the Enterprise Update Scan Tool is created for a specific bulletin, customers can run the tool from a command line interface (CLI) and view the results of the XML output file. To help customers better utilize the tool, detailed documentation will be provided with the tool. There is also a version of the tool that offers an integrated experience for SMS administrators.

Can I use a version of the Enterprise Update Scan Tool (EST) to determine whether this update is required?
Yes. Microsoft has created a version of the EST that will determine if you have to apply this update. For download links and more information about the version of the EST that is being released this month, see the following Microsoft Web site. SMS customers should review the "Can I use Systems

See “Can I use Systems Management Server (SMS) to determine whether this update is required?" FAQ for more information about SMS and EST.

Can I use Systems Management Server (SMS) to determine whether this update is required?
The following table provides the SMS detection summary for this security update.
Product SMS 2.0 SMS 2003

Outlook Express 6 on Windows XP Service Pack 2

Yes (with EST)

Yes

Outlook Express 6 on Microsoft Windows XP Professional x64 Edition

No

Yes

Outlook Express 6 on Microsoft Windows Server 2003 Service Pack 1

Yes (with EST)

Yes

Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition

No

Yes

Outlook Express 6 on Windows Server 2003 with SP1 for Itanium-based Systems

No

Yes

SMS uses MBSA for detection. Therefore, SMS has the same limitation that is listed earlier in this bulletin related to programs that MBSA does not detect.

For SMS 2.0, the SMS SUS Feature Pack, which includes the Security Update Inventory Tool, can be used by SMS to detect security updates. SMS SUIT uses the MBSA 1.2.1 engine for detection. For more information about the Security Update Inventory Tool, visit the following Microsoft Web site. For more information about the limitations of the Security Update Inventory Tool, see Microsoft Knowledge Base Article 306460. The SMS SUS Feature Pack also includes the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications.

For SMS 2003, the SMS 2003 Inventory Tool for Microsoft Updates can be used by SMS to detect security updates that are offered by Microsoft Update and that are supported by Windows Server Update Services. For more information about the SMS 2003 Inventory Tool for Microsoft Updates, visit the following Microsoft Web site. SMS 2003 can also use the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications.

For more information about SMS, visit the SMS Web site.
Top of sectionTop of section

Vulnerability Details

MHTML Parsing Vulnerability - CVE-2006-2766:

There is a remote code execution vulnerability in Windows that results from incorrect parsing of the MHTML protocol. An attacker could exploit the vulnerability by constructing a specially crafted Web page or HTML e-mail that could potentially lead to remote code execution if a user visited a specially crafted Web site or clicked a link in a specially crafted e-mail message.

If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

Mitigating Factors for MHTML Parsing Vulnerability - CVE-2006-2766:

In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or instant messenger message that takes users to the attacker's Web site.

An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

By default, Outlook Express 6 opens HTML e-mail messages in the Restricted sites zone.

The Restricted sites zone helps limit attacks that could try to exploit this vulnerability by preventing ActiveX Controls from being used when reading HTML e-mail messages. However, if a user clicks a link in an e-mail message, the use could still be vulnerable to this issue through the Web-based attack scenario.

By default, Internet Explorer on Windows Server 2003 runs in a restricted mode that is known as Enhanced Security Configuration. This mode mitigates this vulnerability in the e-mail vector because reading e-mail messages in plain text is the default configuration for Outlook Express. See the FAQ section for this security update for more information about Internet Explorer Enhanced Security Configuration.
Top of sectionTop of section

Workarounds for MHTML Parsing Vulnerability - CVE-2006-2766:

Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

Modify the Access Control List to disable the MHTML Protocol registry key
Modifying the Access Control List on the “MHTML Protocol” registry key helps protect the affected system from attempts to exploit this vulnerability. To modify the MHTML Protocol registry key, follow these steps.

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

Note We recommend backing up the registry before you edit it.

Note Make a note of the permissions that are listed in the dialog box so that you can restore them to their original values at a later time

Click Start, click Run, type "regedit" (without the quotation marks), and then click OK.

Expand HKEY_CLASSES_ROOT, expand CLSID, and then click {05300401-BCBC-11d0-85E3-00C04FD85AB4}.

Click Edit, and then click Permissions.

Click Advanced.

Click to clear the Inherit from parent the permission entries that apply to child objects. Include these with entries explicitly defined here. check box. You are prompted to click Copy, Remove, or Cancel. Click Remove, and then check OK.

You receive a message that states that no one will be able to access this registry key. Click Yes, and then click OK to close the Permissions for {05300401-BCBC-11d0-85E3-00C04FD85AB4} dialog box.

Impact of Workaround: This workaround disables page rendering for MHTML Web pages.
Top of sectionTop of section

FAQ for MHTML Parsing Vulnerability - CVE-2006-2766:

What is the scope of the vulnerability?
There is a remote code execution vulnerability in Windows that results from incorrect parsing of the MHTML protocol. An attacker could exploit the vulnerability by constructing a specially crafted Web page or HTML e-mail that could potentially lead to remote code execution if a user visited a specially crafted Web site or clicked a link in a specially crafted e-mail message.

If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

What causes the vulnerability?
Windows incorrectly parses the MHTML protocol.

What is MHTML?
MHTML extends HTML to embed encoded objects, such as images, in the HTML document. Although it is actually the HTML rendering extension that renders MHTML, this functionality may also be referred to as the MHTML rendering extension.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

What are Internet Explorer security zones?
Internet Explorer security zones are part of a system that divides online content into categories or zones, based on the trustworthiness of the content. Specific Web domains can be assigned to a zone, depending on how much trust is put in the content of each domain. The zone then restricts the capabilities of the Web content, based on the zone's policy. By default, most Internet domains are treated as part of the Internet zone. By default, the policy of the Internet zone prevents scripts and other active code from accessing resources on the local system.

How could an attacker exploit the vulnerability?
An attacker could host a specially crafted Web site or HTML e-mail message that is designed to exploit this vulnerability through Internet Explorer and then persuade a user to view the Web site or HTML e-mail message. This can also include Web sites that accept user-provided content or advertisements, Web sites that host user-provided content or advertisements, and compromised Web sites. These Web sites could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger request that takes users to the attacker's Web site. It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems.

What systems are primarily at risk from the vulnerability?
This vulnerability requires a user to be logged on and visiting a Web site for any malicious action to occur. Therefore, any systems where Internet Explorer is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability.

What does the update do?
The update removes the vulnerability by changing Windows so that it correctly parses the MHTML protocol.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2006-2766.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had seen examples of proof of concept code published publicly but had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Does applying this security update help protect customers from the code that has been published publicly that attempts to exploit this vulnerability?
Yes. This security update addresses the vulnerability that potentially could be exploited by using the published proof of concept code. The vulnerability that has been addressed has been assigned the Common Vulnerability and Exposure number CVE-2006-2766.

Disclaimer:

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:

V1.0 (August 8, 2006): Bulletin published.

Related for SECURITYVULNS:DOC:13792