-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2010.0210
        Vulnerability in VBScript Could Allow Remote Code Execution
                               2 March 2010

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Internet Explorer
Publisher:         Microsoft
Operating System:  Windows 2000
                   Windows XP
                   Windows Server 2003
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:        Mitigation
CVE Names:         CVE-2010-0483  

Original Bulletin: 
   http://www.microsoft.com/technet/security/advisory/981169.mspx

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Advisory (981169)

Vulnerability in VBScript Could Allow Remote Code Execution

Published: March 01, 2010

Version: 1.0

General Information

Executive Summary

  Microsoft is investigating new public reports of a vulnerability in VBScript
  that is exposed on supported versions of Microsoft Windows 2000, Windows XP,
  and Windows Server 2003 through the use of Internet Explorer. Our
  investigation has shown that the vulnerability cannot be exploited on
  Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008.
  The main impact of the vulnerability is remote code execution. We are not
  aware of attacks that try to use the reported vulnerabilities or of customer
  impact at this time.

  The vulnerability exists in the way that VBScript interacts with Windows Help
  files when using Internet Explorer. If a malicious Web site displayed a
  specially crafted dialog box and a user pressed the F1 key, arbitrary code
  could be executed in the security context of the currently logged-on user.
  On systems running Windows Server 2003, Internet Explorer Enhanced Security
  Configuration is enabled by default, which helps to mitigate against this
  issue.

  We are actively working with partners in our Microsoft Active Protections
  Program (MAPP) to provide information that they can use to provide broader
  protections to customers.

  Upon completion of this investigation, Microsoft will take the appropriate
  action to help protect our customers. This may include providing a security
  update through our monthly release process or providing an out-of-cycle
  security update, depending on customer needs.

  Microsoft is concerned that this new report of a vulnerability was not
  responsibly disclosed, potentially putting computer users at risk. We
  continue to encourage responsible disclosure of vulnerabilities. We believe
  the commonly accepted practice of reporting vulnerabilities directly to a
  vendor serves everyone's best interests. This practice helps to ensure that
  customers receive comprehensive, high-quality updates for security
  vulnerabilities without exposure to malicious attackers while the update
  is being developed.


Affected Software

  Microsoft Windows 2000 Service Pack 4
  Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP
    Professional x64 Edition Service Pack 2
  Windows Server 2003 Service Pack 2, Windows Server 2003 with SP2 for
    Itanium-based Systems, and Windows Server 2003 x64 Edition Service
    Pack 2

	
Mitigating Factors

  Mitigation refers to a setting, common configuration, or general
  best-practice, existing in a default state, that could reduce the severity of
  this issue. The following mitigating factors may be helpful in your
  situation:

  This vulnerability cannot be exploited on Windows 7, Windows Server 2008 R2,
  Windows Vista, or Windows Server 2008.
	
  The vulnerability requires user interaction. The vulnerability could not be
  exploited without user interaction even if the user visited a malicious Web
  site. Instead, an attacker would need to persuade a user to press the F1 key
  on the keyboard while the Web site displays a scripted dialog box.
	
  In a Web-based attack scenario, an attacker could host a Web site that
  contains a Web page that is used to exploit this vulnerability. In addition,
  compromised Web sites and Web sites that accept or host user-provided content
  or advertisements could contain specially crafted content that could exploit
  this vulnerability. In all cases, however, an attacker would have no way to
  force users to visit these Web sites. Instead, an attacker would have to
  convince users to visit the Web site, typically by getting them to click a
  link in an e-mail message or Instant Messenger message that takes users to
  the attackers Web site.

  An attacker who successfully exploited this vulnerability could gain the
  same user rights as the local user. Users whose accounts are configured to
  have fewer user rights on the system could be less affected than users who
  operate with administrative user rights.
	
  By default, Internet Explorer on Windows Server 2003 runs in a restricted mode
  that is known as Enhanced Security Configuration. This mode sets the security
  level for the Internet zone to High. This is a mitigating factor for Web sites
  that you have not added to the Internet Explorer Trusted sites zone.
	
  By default, all supported versions of Microsoft Outlook, Microsoft Outlook
  Express, and Windows Mail open HTML e-mail messages in the Restricted sites
  zone, removing the risk of an attacker being able to use this vulnerability to
  execute malicious code. The Restricted sites zone helps mitigate attacks that
  could try to exploit this vulnerability by preventing Active Scripting and
  ActiveX controls from being used when reading HTML e-mail messages. However,
  if a user clicks a link in an e-mail message, the user could still be
  vulnerable to exploitation of this vulnerability through the Web-based 
  attack scenario. Additionally, Outlook 2007 uses a different component to
  render HTML e-mail, removing the risk of this exploit.


Workarounds

  Workaround refers to a setting or configuration change that does not correct
  the underlying issue but would help block known attack vectors before you
  apply the update. Microsoft has tested the following workarounds and states
  in the discussion whether a workaround reduces functionality:
	

  o Do not press the F1 key when prompted by a Web site

    Successful exploitation of this vulnerability requires that users assist
    the exploit by pressing the F1 key on their keyboard. Our analysis shows
    that if users do not press the F1 key on their keyboard, the vulnerability
    cannot be exploited.

    Consequently, malicious Web sites may attempt to persuade users into
    pressing the F1 key. Such a Web site could invoke an endless loop of dialog
    boxes that tell the user to press the F1 key to end the loop, or offer
    information such as pricing information or help to be revealed through
    the F1 key.

    Users are advised to avoid pressing F1 presented by Web pages or other
    Internet content. If a dialog box appears repeatedly in an attempt to
    convince the user to press F1, users may log off the system or use Task
    Manager to terminate the Internet Explorer process.
	

  o Restrict access to the Windows Help System

    Successful exploitation of this vulnerability requires that the Windows Help
    System is functioning. You can help protect against exploitation of this
    vulnerability if you modify the ACL on winhlp32.exe to be more restrictive
    on Windows 2000, Windows XP and Windows Server 2003 by running the following
    command from an administrative command line:

      echo Y | cacls "%windir%\winhlp32.exe" /E /P everyone:N

    Impact of workaround. The Windows Help System will be unavailable, and users 
    may not be able to invoke the help function in applications. The attempt to open
    the help function in applications may lead to an error message.

    How to undo the workaround:

    Run the following command from an administrative command line:

      echo Y | cacls "%windir%\winhlp32.exe" /E /R everyone


  o Set Internet and Local intranet security zone settings to "High" to block
    ActiveX Controls and Active Scripting in these zones

    You can help protect against exploitation of this vulnerability by changing
    your settings for the Internet security zone to prompt before running
    ActiveX controls and Active Scripting. You can do this by setting your
    browser security to High.

    To raise the browsing security level in Internet Explorer, follow these
    steps:

    1. On the Internet Explorer Tools menu, click Internet Options.

    2. In the Internet Options dialog box, click the Security tab, and then
       click the Internet icon.

    3. Under Security level for this zone, move the slider to High. This sets
       the security level for all Web sites you visit to High.

    Note: If no slider is visible, click Default Level, and then move the
    slider to High.

    Note: Setting the level to High may cause some Web sites to work
    incorrectly. If you have difficulty using a Web site after you change this
    setting, and you are sure the site is safe to use, you can add that site to
    your list of trusted sites. This will allow the site to work correctly even
    with the security setting set to High.

    Impact of workaround. There are side effects to blocking ActiveX Controls and
    Active Scripting. Many Web sites that are on the Internet or on an intranet
    use ActiveX or Active Scripting to provide additional functionality. For
    example, an online e-commerce site or banking site may use ActiveX Controls to
    provide menus, ordering forms, or even account statements. Blocking ActiveX
    Controls or Active Scripting is a global setting that affects all Internet and
    intranet sites. If you do not want ActiveX Controls and Active Scripting to be
    blocked for all these sites, use the steps outlined in "Add sites that you
    trust to the Internet Explorer Trusted sites zone".


  o Add sites that you trust to the Internet Explorer Trusted sites zone

    After you set Internet Explorer to require a prompt before it runs
    ActiveX controls and Active Scripting in the Internet zone and in the Local
    intranet zone, you can add sites that you trust to the Internet Explorer
    Trusted sites zone. This will allow you to continue to use trusted Web sites
    exactly as you do today, while helping to protect you from this attack on
    untrusted sites. We recommend that you add only sites that you trust to the
    Trusted sites zone.

    To do this, follow these steps:

    1. In Internet Explorer, click Tools, click Internet Options, and then click
       the Security tab.

    2. In the Select a Web content zone to specify its current security settings
       box, click Trusted Sites, and then click Sites.
    
    3. If you want to add sites that do not require an encrypted channel, click
       to clear the Require server verification (https:) for all sites in this
       zone check box.

    4. In the Add this Web site to the zone box, type the URL of a site that you
       trust, and then click Add.

    5. Repeat these steps for each site that you want to add to the zone.

    6. Click OK two times to accept the changes and return to Internet
       Explorer.

    Note: Add any sites that you trust not to take malicious action on your
    system. Two in particular that you may want to add are
    *.windowsupdate.microsoft.com and *.update.microsoft.com. These are the
    sites that will host the update, and it requires an ActiveX Control to
    install the update.
	

  o Configure Internet Explorer to prompt before running Active Scripting or to
    disable Active Scripting in the Internet and Local intranet security zone

    You can help protect against exploitation of this vulnerability by changing
    your settings to prompt before running Active Scripting or to disable
    Active Scripting in the Internet and Local intranet security zone. To do
    this, follow these steps:

    1. In Internet Explorer, click Internet Options on the Tools menu.

    2. Click the Security tab.

    3. Click Internet, and then click Custom Level.

    4. Under Settings, in the Scripting section, under Active Scripting,
       click Prompt or Disable, and then click OK.

    5. Click Local intranet, and then click Custom Level.

    6. Under Settings, in the Scripting section, under Active Scripting,
       click Prompt or Disable, and then click OK.

    7. Click OK two times to return to Internet Explorer.

    Note: Disabling Active Scripting in the Internet and Local intranet
    security zones may cause some Web sites to work incorrectly. If you have
    difficulty using a Web site after you change this setting, and you are sure
    the site is safe to use, you can add that site to your list of trusted sites.
    This will allow the site to work correctly.

    Impact of workaround. There are side effects to prompting before running
    Active Scripting. Many Web sites that are on the Internet or on an intranet
    use Active Scripting to provide additional functionality. For example, an
    online e-commerce site or banking site may use Active Scripting to provide
    menus, ordering forms, or even account statements. Prompting before running
    Active Scripting is a global setting that affects all Internet and intranet
    sites. You will be prompted frequently when you enable this workaround. For
    each prompt, if you feel you trust the site that you are visiting, click Yes
    to run Active Scripting. If you do not want to be prompted for all these sites,
    use the steps outlined in "Add sites that you trust to the Internet Explorer
    Trusted sites zone".


  o Add sites that you trust to the Internet Explorer Trusted sites zone

    After you set Internet Explorer to require a prompt before it runs ActiveX
    controls and Active Scripting in the Internet zone and in the Local intranet
    zone, you can add sites that you trust to the Internet Explorer Trusted
    sites zone. This will allow you to continue to use trusted Web sites exactly
    as you do today, while helping to protect you from this attack on untrusted
    sites. We recommend that you add only sites that you trust to the Trusted
    sites zone.

    To do this, follow these steps:

    1. In Internet Explorer, click Tools, click Internet Options, and then
       click the Security tab.

    2. In the Select a Web content zone to specify its current security settings
       box, click Trusted Sites, and then click Sites.

    3. If you want to add sites that do not require an encrypted channel, click
       to clear the Require server verification (https:) for all sites in this
       zone check box.

    4. In the Add this Web site to the zone box, type the URL of a site that you
       trust, and then click Add.

    5. Repeat these steps for each site that you want to add to the zone.

    6. Click OK two times to accept the changes and return to Internet
       Explorer.

    Note: Add any sites that you trust not to take malicious action on your
    system. Two in particular that you may want to add are
    *.windowsupdate.microsoft.com and *.update.microsoft.com. These are the
    sites that will host the update, and it requires an ActiveX Control to
    install the update.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFLjFTH/iFOrG6YcBERArlkAJ9w2wzINw3V0l4Ik9poQ5RxWkyMrgCfXPTn
TUjknWCjSR/a0EIbt0/lw00=
=neIz
-----END PGP SIGNATURE-----