HTTP: Internet Explorer HTML Help Zone Bypass

This signature detects attempts to invoke the HTML Help ActiveX control in a web page with the location of the help file set to a local file. If attackers have previously placed a help file on the local drive, they can use this exploit to execute code with user privileges on a target host running Microsoft Internet Explorer.

Extended Description

Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."

Affected Products

Microsoft internet_explorer

References

BugTraq: 11467

CVE: CVE-2004-1043

URL: http://www.microsoft.com/technet/security/Bulletin/MS05-001.mspx http://www.kb.cert.org/vuls/id/939688

Short Name

HTTP:STC:IE:HTML-HELP-ZONE-BP

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: Internet Explorer HTML Help Zone Bypass

Extended Description

Affected Products

References

Found a potential security threat?