Software Engineering Institute

The Microsoft Windows HTML help facility (part of Internet Explorer) is able to execute arbitrary programs through an embedded "shortcut" in a compiled HTML file. This allows the help system to start wizards and other programs as part of the help facility. Unfortunately, it also makes it unsafe for users to open help files obtained from untrusted sources.

An attacker who can construct a malicious help file and place it in a location accessible by the victim may be able to cause this help file to be loaded and the embedded shortcuts executed without interaction from the victim. A malicious web site author may cause a compiled HTML help file to be opened through the Active Scripting showHelp call in Internet Explorer. Help files may also be opened in other environments that support Active Scripting, such as email messages in Outlook.

The specific exploit described (and corrected) by Microsoft involves an attacker who makes the malicious help files available via a UNC share. The patch corrects this aspect of the problem by allowing help files to execute shortcuts only when "located on the user's local machine." More information about Microsoft's security bulletin and their patch is available from

http://microsoft.com/technet/security/bulletin/ms00-037.asp
http://microsoft.com/technet/security/bulletin/fq00-037.asp

Preconditions Required for Exploitation

Unfortunately, the Microsoft patch does not address several significant ways in which the vulnerability can be exploited. The vulnerability can be exploited in any situation where all of the following conditions are met:

1. The attacker must entice or compel a victim who has Active Scripting enabled to open an email message or visit a web page. Alternatively, the attacker could attempt to trick the victim into opening the compiled help file, such as by sending it as an attachment in an email message. Since it is not yet widely recognized that help files have the potential to be just as dangerous as an untrusted executable, this may not be difficult.
2. The attacker must be able to place a malicious help file in a location accessible to the user when the Active Script is executed. The attacker must also be able to predict or guess the path to this file. If the patch described in Microsoft Security Bulletin MS00-037 has been applied, this file may not reside on a UNC share (\\hostname\path\file). That is, if the patch has not been installed, an intruder must be able to place a file anywhere that the victim can access it. If the patch has been installed, the intruder must be able to place a file anywhere that the victim can access it except on UNC shares.
3. The Active Script mentioned above must run in a security zone that allows ActiveX controls to run and allows the scripting of controls that are marked "safe for scripting." The default security settings for the Internet Zone and the My Computer zone allow these actions to occur without warning prompts.
4. The HHCtrl ActiveX control must be installed and be marked "safe for scripting" and "safe for initialization." This is the default configuration when Internet Explorer is installed.

• Sharing files via a network filesystem such as AFS, DFS, NFS, Novell Netware, or Windows shares when users map these drives to local drive letters. When the drive letter is not predictable but the path to the file is, the attacker may be able to make multiple exploit attempts because failed calls to showHelp generate no error messages. Access control lists cannot be used to defend yourself against this problem because the ACL facility allows the intruder to give you access to malicious files they control without your consent.
• Sharing physical disk drives in environments such as academic labs, Internet cafes, or libraries, where an attacker may be able to store malicious files in a writable local directory.
• Using any of several products that automatically extract attachments from email messages and place them in predictable locations. A notable example of this is Eudora.
• Using chat clients such as IRC-II, ICQ, or AOL Instant Messenger in modes that allow unsolicited file transfers to be placed in a local directory.
• Hosting an anonymous FTP site, if the upload directory is accessible by local users.

By using the showHelp Active Scripting call in conjunction with shortcuts embedded in a malicious help file, attackers are able to execute programs and ActiveX controls of their choice. Since exploitation of the vulnerability requires an attacker to place a compiled help file (CHM) in a location accessible to the victim, it is usually trivial to include a malicious executable as well. In this situation, the attacker can take any action that the victim can.
The essence of the problem is this:

The ability for an intruder to make a file accessible to a victim running Internet Explorer is equivalent to the ability to execute arbitrary code on the victim's system if several common preconditions are met.

It is important to note that a number of other vulnerabilities facilitate the process of making a malicious CHM file accessible to a victim. Accessing untrusted HTML documents (web sites, HTML-formatted email messages) with Active Scripting enabled can allow attackers to exploit this vulnerablilty.

Update HTML Help.
Install an updated version of HTML Help (811630). As described in Microsoft Security Bulletin MS03-015, the updated HHCtrl control disables the Shortcut command in a compiled help file that has been opened with the showHelp method:

• Only supported protocols [http:, https:, file:, ftp:, ms-its:, or mk:@MSITStore:] can be used with showHelp to open a web page or help (chm) file.
• The shortcut function supported by HTML Help will be disabled when the help file is opened with showHelp This will not affect the shortcut functionality if the same CHM file is opened by the user manually by double-clicking on the help file, or by through an application on the local system using the HTMLHELP( ) API.

Caveat: The CERT/CC developed the following information based on our independent tests using primarily Internet Explorer 5 on Microsoft Windows NT 4.0 and Windows 2000. Your results will vary based on your particular configuration.
For some sites, the patch provided by Microsoft is adequate. For others, particularly those sites using non-Microsoft networking products, the patch does not provide complete protection. You will need to understand your network's configuration prior to deciding which, if any, changes are appropriate.

Configure Outlook to read email in the Restricted Zone.

Because an email message may start Internet Explorer automatically if Active Scripting is enabled, the CERT/CC encourages you to configure your Outlook email client to use the Restricted Zone, and to disable Active Scripting in this zone. This solution should be implemented in addition to one of the changes mentioned earlier.

The steps for configuring Outlook to use the Restricted Zone are:

1. Start Outlook as you normally would.
2. From the Tools menu select Options.... The Options dialog box appears.
3. Select the Security tab. The Security Options panel appears.
4. In the Secure content section, change the pull-down menu from Internet to Restricted Sites.
5. Click Apply to save your changes.
6. Click OK to close the Options dialog box.

1. Start Internet Explorer as you normally would.
2. From the Tools menu select Internet Options.... The Internet Options dialog box appears.
3. Select the Security tab. The Security Options panel appears.
4. Select the zone you wish to change. For most users, this is the Internet Zone, but depending on your circumstances, you may need to repeat these steps for the Local Intranet Zone as well.
5. Click the Custom Level button. The Security Settings panel appears.
6. Change one or more of the following settings based on the information provided earlier and your desired level of security.
   1. Set Run ActiveX controls and plug-ins to administrator approved, disable, or prompt.
   2. Set Script ActiveX controls marked safe for scripting to disable or prompt.
   3. Set Active scripting to disable or prompt.
7. Click OK to accept these changes. A dialog box appears asking if you are sure you want to make these changes.
8. Click Yes.
9. Click Apply to save your changes.
10. Click OK to close the Internet Options dialog box.

Security zones can also be used to enable Active Scripting and ActiveX controls at specific sites where you wish to retain this functionality. To place a site in the Trusted Sites Zone using Internet Explorer 5.0 on Windows NT 4.0,

1. Start Internet Explorer as you normally would.
2. From the Tools menu select Internet Options.... The Internet Options dialog box appears.
3. Select the Security tab. The Security Options panel appears.
4. Select the Trusted Sites Zone.
5. Click the Sites... button.
6. Enter the name of the trusted site in the Add this Web Site to the zone: text box.
7. Click the Add button.
8. If a dialog box appears saying "Sites added to this zone must use the https:// prefix. This prefix assures a secure connection":
   
   1. Click OK.
   2. Add https:// to the beginning of the site name, and try to add the site again.
   3. Or uncheck the box at the bottom of the dialog box marked Require server verification (https:) for all sites in this zone. Making this change reduces the security of your system by not requiring certificate based authentication, relying instead on DNS based verification which could be misleading. The CERT/CC encourages you not to make this change unless you fully understand the implications. If you choose not to require certificate based verification, you may wish to reduce other security settings for the Trusted Sites Zone.
9. Click OK to save the new list of sites.
10. Click Apply to save your changes.
11. Click OK to close the Internet Options dialog box.