[security-alerts] FW: [SA20384] Microsoft Windows "mhtml:" URI Buffer Overflow Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ----------------------------------------------------------------------
> 
> TITLE:
> Microsoft Windows "mhtml:" URI Buffer Overflow Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA20384
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/20384/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> DoS
> 
> WHERE:
> From remote
> 
> OPERATING SYSTEM:
> Microsoft Windows XP Professional
> http://secunia.com/product/22/
> Microsoft Windows XP Home Edition
> http://secunia.com/product/16/
> Microsoft Windows Server 2003 Web Edition
> http://secunia.com/product/1176/
> Microsoft Windows Server 2003 Standard Edition
> http://secunia.com/product/1173/
> Microsoft Windows Server 2003 Datacenter Edition
> http://secunia.com/product/1175/
> Microsoft Windows Server 2003 Enterprise Edition
> http://secunia.com/product/1174/
> 
> DESCRIPTION:
> Mr.Niega has discovered a vulnerability in Microsoft Windows, which
> can be exploited by malicious people to cause a DoS (Denial of
> Service) on certain applications on a user's system.
> 
> The vulnerability is caused due to a boundary error in inetcomm.dll
> within the processing of URLs with the "mhtml:" URI handler. This can
> be exploited to cause a stack-based buffer overflow via an overly long
> URL by e.g. tricking a user into visiting a malicious web site with
> Internet Explorer or opening a specially crafted Internet shortcut.
> 
> Successful exploitation crashes the application using the vulnerable
> library. Execution of arbitrary code may be possible, but has
> currently not been proven as it is prevented by the DEP (Data
> Execution Prevention) mechanism.
> 
> The vulnerability has been confirmed on a fully patched system with
> Microsoft Windows XP SP2 and Microsoft Windows 2003 Server.
> 
> SOLUTION:
> Disable the "mhtml:" URI handler. This may affect the functionality.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Mr.Niega
>