Microsoft Security Bulletin MS03-032

Technical description:

Microsoft originally issued this bulletin on August 20th, 2003. Subsequent to issuing the security bulletin, Microsoft received reports that the patch provided with this bulletin does not properly correct the Object Type Vulnerability (CAN-2003-0532).

Microsoft also identified a problem that specifically affects Windows XP systems that are configured as web servers serving ASP.NET web pages and causes clients connecting to the web server to receive an error when they attempt to view pages on the site. This problem only affects Windows XP computers that have installed Internet Information Services (IIS) 5.1 (which is not installed by default) and configured with the .NET Framework version 1.0 to serve ASP.NET based Web pages--it does not affect other versions of Windows. Microsoft has published a knowledge base article 827641 that provides steps to work around this issue while maintaining the level of protection provided by the security patch.

Microsoft has investigated these reports and has issued a new bulletin with an updated patch that corrects these problems. Microsoft has released security bulletin MS03-040 which supersedes this bulletin.

This is a cumulative patch that includes the functionality of all previously released patches for Internet Explorer 5.01, 5.5 and 6.0. In addition, it eliminates the following newly discovered vulnerabilities:

• A vulnerability involving the cross-domain security model of Internet Explorer, which keeps windows of different domains from sharing information. This flaw could result in the execution of script in the My Computer zone. To exploit this flaw, an attacker would have to host a malicious Web site that contained a Web page designed to exploit this particular vulnerability and then persuade a user to visit that site. After the user has visited the malicious Web site, it would be possible for the attacker to run malicious script by misusing the method Internet Explorer uses to retrieve files from the browser cache, and cause that script to access information in a different domain. In the worst case, this could enable the Web site operator to load malicious script code onto a user's system in the security context of the My Computer zone. In addition, this flaw could also enable an attacker to run an executable file that was already present on the local system or view files on the computer. The flaw exists because a file from the Internet or intranet with a maliciously constructed URL can appear in the browser cache running in the My Computer zone.
• A vulnerability that occurs because Internet Explorer does not properly determine an object type returned from a Web server. It could be possible for an attacker who exploited this vulnerability to run arbitrary code on a user's system. If a user visited an attacker's Web site, it would be possible for the attacker to exploit this vulnerability without any other user action. An attacker could also craft an HTML-based e-mail that would attempt to exploit this vulnerability.

This patch also sets the Kill Bit on the BR549.DLL ActiveX control. This control implemented support for the Windows Reporting Tool, which is no longer supported by Internet Explorer. The control has been found to contain a security vulnerability. To protect customers who have this control installed, the patch prevents the control from running or from being reintroduced onto users' systems by setting the Kill Bit for this control. This issue is discussed further in Microsoft Knowledge Base article 822925.

In addition to these vulnerabilities, a change has been made to the way Internet Explorer renders HTML files. This change addresses a flaw in the way Internet Explorer renders Web pages that could cause the browser or Outlook Express to fail. Internet Explorer does not properly render an input type tag. A user visiting an attacker's Web site could allow the attacker to exploit the vulnerability by viewing the site. In addition, an attacker could craft a specially formed HTML-based e-mail that could cause Outlook Express to fail when the e-mail was opened or previewed.

This patch also contains a modification to the fix for the Object Type vulnerability (CAN-2003-0344) corrected in Microsoft Security Bulletin MS03-020. The modification corrects the behavior of the fix to prevent the attack on specific languages.

To exploit these flaws, the attacker would have to create a specially formed HTML-based e-mail and send it to the user. Alternatively an attacker would have to host a malicious Web site that contained a Web page designed to exploit these vulnerabilities. The attacker would then have to persuade a user to visit that site.

As with the previous Internet Explorer cumulative patches released with bulletins MS03-004, MS03-015, and MS03-020 this cumulative patch will cause window.showHelp( ) to cease to function if you have not applied the HTML Help update. If you have installed the updated HTML Help control from Knowledge Base article 811630, you will still be able to use HTML Help functionality after applying this patch.

Mitigating factors:

• By default, Internet Explorer on Windows Server 2003 runs in Enhanced Security Configuration. This default configuration of Internet Explorer blocks these attacks. If Internet Explorer Enhanced Security Configuration has been disabled, the protections put in place that prevent these vulnerabilities from being exploited would be removed.
• In the Web-based attack scenario, the attacker would have to host a Web site that contained a Web page used to exploit these vulnerabilities. An attacker would have no way to force users to visit a malicious Web site outside the HTML-based e-mail vector. Instead, the attacker would need to lure them there, typically by getting them to click a link that would take them to the attacker's site.
• Code that executed on the system would only run under the privileges of the logged-on user.

Severity Rating:

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability identifier:

• BR549.DLL Buffer Overrun:CAN-2003-0530
• Browser Cache Script Execution in My Computer Zone:CAN-2003-0531
• Object Type Vulnerability:CAN-2003-0532

Tested Versions:

Internet Explorer versions 5.01 Service Pack 3, Internet Explorer 5.01 Service Pack 4, Internet Explorer 5.5 Service pack 2, Internet Explorer 6.0 and Internet Explorer 6.0 Service Pack 1 were tested for these vulnerabilities. Previous versions are no longer supported, and may or may not be affected by these vulnerabilities. More information on Windows Operating System Components Lifecycles is available from:

http://www.microsoft.com/lifecycle/.

Why has Microsoft revised this bulletin?
Subsequent to issuing this security bulletin, Microsoft received reports that the patch provided with this bulletin does not properly correct the Object Type Vulnerability (CAN-2003-0532).
Microsoft also identified a problem that specifically affects Windows XP systems that are configured as web servers serving ASP.NET web pages and causes clients connecting to the web server to receive an error when they attempt to view pages on the site. This problem only affects Windows XP computers that have installed Internet Information Services (IIS) 5.1 (which is not installed by default) and configured with the .NET Framework version 1.0 to serve ASP.NET based Web pages--it does not affect other versions of Windows. Microsoft has published a knowledge base article 827641 that provides steps to work around this issue while maintaining the level of protection provided by the security patch.
Microsoft has investigated these reports and has issued a new bulletin with an updated patch that corrects these problems. Microsoft has released security bulletin MS03-040 which supersedes this bulletin.

What vulnerabilities are eliminated by this patch?
This is a cumulative patch that incorporates the functionality of all previously released patches for Internet Explorer. In addition, the patch eliminates the following newly reported vulnerabilities:

• A vulnerability that could allow an attacker to cause arbitrary code to run on the user's system.
• A vulnerability that could allow an attacker to cause script code to run on the user's system.

Does the Patch contain any other security changes?
Yes. This patch sets the Kill Bit on the BR549.DLL ActiveX control. This control implemented support for the Windows Reporting Tool, which is no longer supported by Internet Explorer. The control has been found to contain a security vulnerability. To help protect customers who have this control installed, the patch prevents the control from running or from being reintroduced onto users' systems by setting the Kill Bit for this control. This issue is discussed further in Microsoft Knowledge Base article 822925. In addition this patch also contains a modification to the fix for the Object Type vulnerability (CAN-2003-0344) corrected in Microsoft Security Bulletin MS03-020. The modification corrects the behavior of the fix to prevent the attack on specific languages.

I am running Internet Explorer on Windows Server 2003. Does this mitigate these vulnerabilities?
Yes. By default, Internet Explorer on Windows Server 2003 runs in a restricted mode known as Enhanced Security Configuration.

What is Internet Explorer Enhanced Security Configuration?
Internet Explorer Enhanced Security Configuration is a group of preconfigured Internet Explorer settings that reduce the likelihood of a user or administrator downloading and running malicious Web content on a server. Internet Explorer Enhanced Security Configuration reduces this risk by modifying numerous security-related settings, including Security and Advanced tab settings in Internet Options. Some of the key modifications include:

• Security level for the Internet zone is set to High. This setting disables scripts, ActiveX controls, Microsoft virtual machine (Microsoft VM), HTML content, and file downloads.
• Automatic detection of intranet sites is disabled. This setting assigns all intranet Web sites and all Universal Naming Convention (UNC) paths that are not explicitly listed in the Local intranet zone to the Internet zone.
• Install On Demand and non-Microsoft browser extensions are disabled. This setting prevents Web pages from automatically installing components and prevents non-Microsoft extensions from running.
• Multimedia content is disabled. This setting prevents music, animations, and video clips from running.

Disabling Internet Explorer Enhanced Security Configuration would remove the protections put in place that help prevent this vulnerability from being exploited. For more information about Internet Explorer Enhanced Security Configuration, see the Managing Internet Explorer Enhanced Security Configuration guide. To do so, visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?FamilyID=d41b036c-e2e1-4960-99bb-9757f7e9e31b&DisplayLang=en

Is there any configuration of Windows Server 2003 that is likely to have Internet Explorer Enhanced Security Configuration Disabled?
Yes. Systems Administrators who have deployed Windows Server 2003 as a Terminal Server would likely disable Internet Explorer Enhanced Security Configuration to allow users of the Terminal Server to use Internet Explorer in an unrestricted mode.

CAN-2003-0531: Browser Cache Script Execution in My Computer Zone

What is the scope of this vulnerability?
A flaw in Internet Explorer could allow a malicious Web site operator to access information in another Internet domain, or on the user's local system by injecting specially crafted code when the browser checks for the existence of files in the browser cache. In the worst case, this could enable the Web site operator to load malicious script code onto a user's system in the security context of the My Computer zone. In addition, this flaw could also enable an attacker to run an executable file that is already present on the local system or view files on the computer. The attacker would not be able to pass parameters to the executable, however.

What causes the vulnerability?
The vulnerability results because it is possible when the browser checks for the existence of local files in the browser cache to bypass the cross-domain security model that Internet Explorer implements.

What is meant by "Internet Explorer's cross-domain security model"?
One of the principal security functions of a browser is to ensure that browser windows that are under the control of different Web sites cannot interfere with each other or access each other's data, while still allowing windows from the same site to interact with each other. To differentiate between cooperative and uncooperative browser windows, the concept of a "domain" has been created. A domain is a security boundary. Open windows within the same domain are allowed to interact with each other, but windows from different domains cannot interact with each other. The "cross-domain security model" is the part of the security architecture that keeps windows from different domains from interfering with each other.
The simplest example of a domain is associated with Web sites. If you visit www.microsoft.com, and it opens a window to www.microsoft.com/security, the two windows can interact with each because both belong to the same domain, www.microsoft.com. However, if you visited www.microsoft.com, and it opened a window to a different Web site, the cross-domain security model would protect the two windows from each other. The concept goes even further. The file system on your local computer, for instance, is also a domain. So, for instance, www.microsoft.com could open a window and show you a file on your hard disk. However, because your local file system is in a different domain from the Web site, the cross-domain security model should prevent the Web site from reading the file that is being displayed.
Internet Explorer security policy can be configured by using the Internet security zones settings in Internet Explorer, or by using a Group Policy.

What are Internet Explorer security zones?
Internet Explorer security zones are a system that divides online content into categories or zones, based on its trustworthiness. Specific Web domains can be assigned to a zone, depending on how much trust is placed in the content of each domain. The zone then restricts the capabilities of the Web content, based on the zone's policy. By default, most Internet domains are treated as part of the Internet zone, which has default policy that prevents scripts and other active code from accessing resources on the local system. By default, files that are stored on the local computer are run in the Local Computer zone.

What's wrong with the way Internet Explorer calculates cross domain security?
Internet Explorer evaluates security when one Web page requests access to resources in another security zone. There is a flaw in the way Internet Explorer checks the originating domain when checking for the existence of local files in the browser cache.

What could this vulnerability enable an attacker to do?
An attacker could use this vulnerability to create a Web page that would allow the attacker to access data across domains. This could include reading local system files not in use by the user or the operating system, provided the attacker knew the full path and file name. It could also include accessing any data that a user chose to share with another Web site. An attacker could also run executable files on the user's local file system without parameters.

How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by creating a malicious Web page and then enticing the user to visit this page. When the user visited the page the attacker could cause script to run in the security context of the My Computer zone. The attacker could also create a Web page that when viewed by the user, would run an executable file that is already on the user's local system. The attacker would be unable to pass parameters to the executable however.

What does the patch do?
The patch corrects the vulnerability by ensuring that Internet Explorer properly validates the file name request when checking to see if a file exists in the local cache.

CAN-2003-0532: Object Tag Vulnerability

What's the scope of this vulnerability?
A flaw in the way Internet Explorer handles a specific HTTP request could allow arbitrary code to execute in the context of the logged-on user, should the user visit a site under the attacker's control.

What causes the vulnerability?
The vulnerability results because Internet Explorer does not properly check a specially crafted HTTP response that can be encountered when Internet Explorer handles an object tag in a web page.

What's wrong with the way Internet Explorer handles object tags?
There is a flaw in the way Internet Explorer determines an object type. Internet Explorer does not conduct a proper parameter check on an HTTP response. The response can point to a particular file type which will then cause an object to be scripted, then run. This could allow an attacker to run arbitrary code on a user's machine.

What could this vulnerability enable an attacker to do?
This vulnerability could enable an attacker to cause Internet Explorer to execute code of the attacker's choice. This would allow an attacker to take any action on a user's system in the security context of the currently logged-on user.

How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by hosting a specially constructed Web page. If the user visited this Web page, Internet Explorer could fail and could allow arbitrary code to execute in the context of the user. Alternatively, an attacker could also craft an HTML-based e-mail that attempts to exploit this vulnerability.

What does the patch do?
The patch addresses the vulnerabilities by ensuring that Internet Explorer performs proper checks when it receives an HTTP response

Workarounds

Are there any workarounds that can be used to block exploitation of this vulnerability until a patch is re-released?
Yes. It should be noted that these workarounds should be considered temporary measures as they just help block paths of attack rather than correcting the underlying vulnerability. Microsoft encourages installing the patch at the earliest opportunity once it becomes available.
The following sections are intended to provide you with information to help protect your computer from attack.

Prompt before running of ActiveX controls in the Internet and Intranet zones: 
You can help protect against this vulnerability by changing your settings for the Internet security zone to prompt before running ActiveX components. To do this, perform the following steps:

• In Internet Explorer, select Tools, Internet Options
• Click on the Security tab
• Highlight the Internet icon and click on the Custom Level button
• Scroll through the list to the Active X controls and plug-ins section
• Under Run ActiveX controls and plug-ins click Prompt
• Click OK
• Highlight the Local Intranet icon and click on the Custom Level button
• Scroll through the list to the Active X controls and plug-ins section
• Under Run ActiveX controls and plug-ins click Prompt
• Click OK; then click OK again to return to Internet Explorer

Restrict Web sites to only your trusted Web sites

After requiring a prompt before running ActiveX in the Internet and Intranet zone, you can add sites that you trust into Internet Explorer's Trusted sites. This will allow you to continue using trusted Web sites exactly as you do today, while protecting you from this attack on untrusted sites.

To do this, perform the following steps:

• In Internet Explorer, select Tools, then Internet Options. Click the Security tab.
• In the box labeled Select a Web content zone to specify its current security settings, click Trusted Sites, then click Sites
• If you want to add sites that do not require an encrypted channel, click to clear the Require server verification (https:) for all sites in this zone check box.
• In the box labeled Add this Web Site to the zone, type the URL of a site that you trust, then click the Add button. Repeat for each site that you want to add to the zone.
• Click OK twice to accept the changes and return to Internet Explorer. Add any sites that you trust not to take malicious action on your computer. One in particular that you may want to add is http://windowsupdate.microsoft.com. This is the site that will host the patch, and it requires the use of an ActiveX control to install the patch.

Are there any side-effects to prompting before running of ActiveX components?
Yes. Many Web sites on the Internet use ActiveX to provide additional functionality. For instance, an online e-commerce site or banking site might use ActiveX controls to provide menus, ordering forms, or even account statements.
Prompting before running ActiveX controls is a global setting for all Internet and Intranet sites. You will be prompted frequently when you enable this work-around. For each prompt, if you feel you trust the site that you are visiting, click Yes to run ActiveX components. If you do not want to be prompted for all of these sites, you can instead use the "Restrict Web sites to only your trusted Web sites" workaround.

Download locations for this patch

• All version except Microsoft Internet Explorer 6.0 for Windows Server 2003
• Microsoft Internet Explorer 6.0 for Windows Server 2003