-=PCTechTalk=- Re: Win ME Patch error

In a message dated 2/27/2003 8:29:29 PM Central Standard Time, 
didnjaknow@xxxxxxxxx writes:

> "Also Microsoft will never send out patch notifications
> by e-mail (or any other method). If there is a patch
> you must find out about it and get it yourself"
> 
_I received the below message from Microsoft.  I subscribe to their security 
alert system.  You will note that they include a URL to reach the fix, But, 
once I receive the notification, I go to the Microsoft windows update site 
and download the patch from there. 
______________________________________________________________________
Forwarded Message: 
Subj:   Microsoft Security Bulletin MS03-006: Flaw in Windows Me Help and 
Support Center Could Enable Code Execution (812709)     
Date:   2/26/2003 1:22:18 PM Central Standard Time  
From:   <A 
HREF="mailto:0_44819_36B88AB3-9EFC-D111-9A90-08002BB6A6BB_US@xxxxxxxxxxxxxxxxxxxxxxxxx";>
0_44819_36B88AB3-9EFC-D111-9A90-08002BB6A6BB_US@xxxxxxxxxxxxxxxxxxxxxxxxx</A>   
Reply-to:   <A 
HREF="mailto:3_44819_36B88AB3-9EFC-D111-9A90-08002BB6A6BB_US@xxxxxxxxxxxxxxxxxxxxxxxxx";>
3_44819_36B88AB3-9EFC-D111-9A90-08002BB6A6BB_US@xxxxxxxxxxxxxxxxxxxxxxxxx</A>   
To: <A HREF="mailto:chazzman@xxxxxxx";>chazzman</A>    
Sent from the Internet (Details)    
    

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------
Title:      Flaw in Windows Me Help and Support Center Could 
            Enable Code Execution (812709)
Date:       26 February, 2003
Software:   Microsoft Windows Me
Impact:     Run Code of Attacker's Choice 
Max Risk:   Critical
Bulletin:   MS03-006

Microsoft encourages customers to review the Security Bulletins 
at: 
http://www.microsoft.com/technet/security/bulletin/MS03-006.asp
http://www.microsoft.com/security/security_bulletins/ms03-006.asp
- -----------------------------------------------------------------

Issue:
======
Help and Support Center provides a centralized facility through 
which users can obtain assistance on a variety of topics. For 
instance, it provides product documentation, assistance in 
determining hardware compatibility, access to Windows Update, 
online help from Microsoft, and other assistance. Users and 
programs can execute URL links to Help and Support Center by 
using the "hcp://" prefix in a URL link instead of "http://";.

A security vulnerability is present in the Windows Me version of 
Help and Support Center, and results because the URL Handler for 
the "hcp://" prefix contains an unchecked buffer.

An attacker could exploit the vulnerability by constructing a URL 
that,when clicked on by the user, would execute code of the 
attacker's choice in the Local Computer security context. The URL 
could be hosted on a web page, or sent directly to the user in 
email. In the web based scenario, where a user then clicked on 
the URL hosted on a website, an attacker could have the ability 
to read or launch files already present on the local machine. In 
the case of an e-mail borne attack, if the user was using Outlook 
Express 6.0 or Outlook 2002 in their default configurations, or 
Outlook 98 or 2000 in conjunction with the Outlook Email Security 
Update, then an attack could not be automated and the user would 
still need to click on a URL sent in e-mail. However if the user 
was not using Outlook Express 6.0 or Outlook 2002 in their 
default configurations, or Outlook 98 or 2000 in conjunction with 
the Outlook Email Security Update, the attacker could cause an 
attack to trigger automatically without the user having to click 
on a URL contained in an e-mail. 

Mitigating Factors:
====================
- The Help and Support Center function could not be started 
automatically in Outlook Express or Outlook if the user is 
running Internet Explorer 6.0 Service Pack 1. 
- For an attack to be successful, the user would need to visit a 
website under the attacker's control or receive an HTML e-mail 
from the attacker. 
- Automatic exploitation of the vulnerability by an HTML email 
would be blocked by Outlook Express 6.0 and Outlook 2002 in their 
default configurations, and by Outlook 98 and 2000 if used in 
conjunction with the Outlook Email Security Update.

Risk Rating:
============
- Critical

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read 
the Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-006.asp
http://www.microsoft.com/security/security_bulletins/ms03-006.asp

for information on obtaining this patch.


- -----------------------------------------------------------------


To unsub or change your email settings:
http://www.freelists.org/webpage/pctechtalk

To access our Archives:
http://groups.yahoo.com/group/PCTechTalk/messages/
http://www.freelists.org/archives/pctechtalk/

For more info:
http://www.freelists.org/cgi-bin/list?list_id=pctechtalk

Other related posts: