-
March 31st, 2003, 05:06 AM
#1
[MSRC 1198dg]-delete XP files using Help and Support Center
I searched and didn't find a reference to this, if it's posted already I apologize.
This was reported back in June of '02 but the only Windows Update that patches the vulnerability is Service Pack 1.
Delete arbitrary files using Help and Support Center
MS Tracking ID: [MSRC 1198dg]
Date Reported: 25/06/02
Date Published: 15/08/02
Vendor: Microsoft
Impact: Delete files through CSS condition in Help Center
Resolution: To be fixed in XP SP1
Tested Applications: IE6 + all service packs (to date of publishing)
Windows XP + all patches (to date of publishing)
Help Center (HelpCtr.exe v5.1.2600.0)
File used: C:windows\PCHEALTH\HELPCTR\SYSTEM\DFS
Possible Fixes: Service Pack 1, XPdite , manual deletion/renaming of file
It is possible to test your system for the vulnerability by entering into any address bar :
hcp://system/DFS/uplddrvinfo.htm?file://c:\test\*
I created a file in C called test and put in some useless files and found that this does infact work. It does not delete the subdirectories, only the files in the directory specified. It is not limited to C: directories, subdirectories can be specified with the same results.
http://www.theregister.co.uk/content/4/27074.html
http://www.security.nnov.ru/search/d...asp?docid=3370
http://unity.skankhouse.org/helpcenter.htm
http://cert.uni-stuttgart.de/archive.../msg00224.html
Faqt
If you want to make God laugh....make plans.
-
March 31st, 2003, 03:15 PM
#2
this HAS been posted...and it is fixed with XPDite from www.grc.com for free, without crappy SP1
- Noia
With all the subtlety of an artillery barrage / Follow blindly, for the true path is sketchy at best. .: Bring OS X to x86!:.
Og ingen kan minnast dei linne drag i dronningas andlet den fagre dag Då landet her kvilte i heilag fred og alle hadde kjærleik å elske med.
-
April 1st, 2003, 03:57 AM
#3
Well darn.
I searched for it for quite awhile before I posted this....didn't find it and thought maybe I was finally going to be able to make a post that was helpfull.
Oh well I guess, I'll get it eventually.
Faqt
If you want to make God laugh....make plans.
-
April 1st, 2003, 05:31 AM
#4
Faqt: Even though it has been posted, I thank you for reposting it. I didn't catch it the first time around, as usual, and appreciate you posting it this time. Don't let negativity get you down, mate.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|