Internet Explorer, Help files, and VBScript - Remote Code Execution Allowed
Microsoft have recently identified an odd vulnerability that utilises VBScript via Internet Explorer to run arbitrary code, all through seemingly-innocuous help files.
From Microsoft's Advisory, any successful exploit requires user interaction, getting the user to press the F1 key after being prompted by a dialog box, nominally bringing up the help function. A weakness in the interaction of VBScript and Windows Help files when using Internet Explorer is the root cause of the vulnerability.
Vulnerable systems include Windows 2000, XP, and 2003 and with the vulnerability having been disclosed publicly before Microsoft were made aware of it, there is a higher risk of successful exploitation than with Microsoft's normal vulnerability disclosure and patching methods. At this stage, there are not any reported attacks making use of this vulnerability.
Mitigating the risk of compromise is the requirement for user interaction, with successful attack only gaining the rights of the current user.
Microsoft's suggested workarounds include not pressing the F1 key when prompted by a website, restricting access to the Windows Help System (effectively disabling it system-wide), and changing the security and scripting settings within Internet Explorer. Relying on user behaviour not to press a key when prompted, and effectively neutering much of the Internet don't really seem like viable long term workarounds for the vulnerability.
With the Security Bulletins for March only a week away, it is unlikely that a patch will be available in this month's release.
3 March 2010
Social bookmark this page at eKstreme.
Alternatively, Bookmark or Share via AddThis
Do you like how we cover Information Security news? How about checking out our company services, delivered the same way our news is.
Let our Free OS X Screen Saver deliver the latest security alerts and commentary to your desktop when you're not at your system.
Comments will soon be available for registered users.
Subscribe to our feed.