From idlabs-advisories@idefense.com Wed Mar 10 04:36:47 2004 From: idlabs-advisories@idefense.com To: idlabs-advisories@idefense.com Date: Tue, 9 Mar 2004 13:13:02 -0500 Reply-To: labs@idefense.com Subject: [Full-Disclosure] iDEFENSE Security Advisory 03.09.04: Microsoft Outlook "mailto:" Parameter Passing Vulnerability Microsoft Outlook "mailto:" Parameter Passing Vulnerability iDEFENSE Security Advisory 03.09.04 www.idefense.com/application/poi/display?id=79&type=vulnerabilities March 09, 2004 I. BACKGROUND Microsoft Outlook provides an integrated solution for managing and organizing e-mail messages, schedules, tasks, notes, contacts, and other information. More information is available at http://www.microsoft.com/outlook/. II. DESCRIPTION Insufficient filtering of parameters passed to Microsoft Corp.'s Outlook e-mail client via the "mailto:" URI (RFC 2368) allows for remote script execution within the "Local Machine" zone. When Outlook is installed, it is enabled as the default e-mail handler. A "mailto:" URI will spawn Outlook with the following command line switches: OUTLOOK.EXE -c IPM.Note /m "... The problem manifests when the string '"' is interspersed within the URI, thereby allowing an attacker to manipulate the command line switches that Outlook is instantiated with. The following example URI: ... mailto:aa" /profile "xx" ... causes Internet Explorer to start Outlook as such: OUTLOOK.EXE -c IPM.Note /m "aa" /profile "xx" If the "Outlook Today" view is the starting view, an attacker can manipulate Outlook to start with a specified URL. In a default installation, this is the case. The URL can be of the form 'javascript:...', allowing an attacker to execute arbitrary script code. In some implementations, this script code executes under the context of the "Local Machine" zone. An attacker does not need to socially engineer a target user into clicking on a malicious link, as the process can be started automatically by embedding the "mailto:" URI within an HTML tag. III. ANALYSIS Successful exploitation allows an attacker to remotely execute arbitrary code under the context of the "Local Machine" zone. Script code executing with such privileges can be crafted to retrieve and execute arbitrary third-party code, thereby leading to further compromise. iDEFENSE has proof of concept exploit code demonstrating the impact of this vulnerability. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in Microsoft Outlook 2002. V. WORKAROUND Microsoft recommends the following workaround strategies: - Do not use "Outlook Today" as the default home page in Outlook 2002. - If you are using Outlook 2002 or Outlook Express 6.0 SP1 or later, read e-mail messages in plain text format to help protect yourself from the HTML e-mail attack vector. Specific details for implementing these workarounds can be found in Microsoft advisory MS04-009 (http://www.microsoft.com/technet/security/Bulletin/MS04-009.mspx). The Microsoft advisory states that "the 'Outlook Today' home page is only the default folder home page when an Outlook profile is originally configured without any e-mail accounts". Our testing has shown that default view is only changed from "Outlook Today" to "Inbox" when email accounts are added via the wizard that appears when Outlook is first launched. The default view does not change when email accounts are added via either the "Tools...E-Mail Accounts" menu within Outlook or "Start...Control Panel...Mail...E-Mail Accounts". This remains true for Outlook 2002 SP3. VI. VENDOR RESPONSE/FIX Microsoft has released the following patches to address this issue: Microsoft Office XP Service Pack 2 http://www.microsoft.com/downloads/details.aspx?FamilyId=52F1A951-24DB-4 4A5-9475-EA5D302BCA6A&displaylang=en Microsoft Outlook 2002 Service Pack 2 http://www.microsoft.com/downloads/details.aspx?FamilyId=52F1A951-24DB-4 4A5-9475-EA5D302BCA6A&displaylang=en VII. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned CAN-2004-0121 to this issue. VIII. DISCLOSURE TIMELINE October 10, 2003 Vulnerability acquired by iDEFENSE November 12, 2003 Initial vendor notification November 12, 2003 Initial vendor response November 21, 2003 iDEFENSE clients notified March 09, 2004 Coordinated public disclosure IX. CREDIT Jouko Pynnönen (http://iki.fi/jouko) is credited with this discovery. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html