Threat of the month
MS Windows Help Center
What is it?
A vulnerability in Microsoft Windows Help and Support Center that was publicly reported by a researcher in June without coordinating it with Microsoft. It's caused by an error when processing escaped URLs through Microsoft Windows Help and Support Center and can be exploited to bypass white-list checks normally imposed on the "-FromHCP" command-line argument.
How does it work?
The vulnerability allows passing arbitrary parameters to local help documents, which combined with additional input sanitation errors in these (e.g. sysinfomain.htm) can be exploited to execute arbitrary commands by tricking a user into opening a specially crafted "hcp://" URL. On systems with Windows Media Player 9 installed, an attack can be executed automatically without user interaction.
Should I be worried?
Yes, particularly if you are running Windows XP with Windows Media Player 9 installed as a known attack vector allows exploitation without user interaction. On other OS versions and systems with later versions of Windows Media Player installed, the current threat is limited as known attack vectors display a prompt, requiring user confirmation before executing.
How can I prevent it?
At the time of writing, Microsoft has not issued a security patch. An unofficial hotfix was made available by the researcher, who reported the vulnerability, but Secunia Research proved that the fix was inadequate.
The best course of action is, therefore, to disable the "hcp:" URI handler.
Ed. note: At press time, Microsoft was planning to deliver a patch.
