What is the fallout from MSHTA.exe vulnerability?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Lido (lidowhoahoh_at_hotmail.com)
Date: 03/19/04 

Date: Fri, 19 Mar 2004 15:49:54 GMT

In searching on-line last night for, of all things, a bathroom scale, I
loaded a web page that had a script that exploited the MSHTA/scripting
vulnerability.

To give maximum disclosure, this was a new system with XP Pro SP1 which
I hadn't updated with any of the security patches. Nor did I have
antivirus software running, as I was put off by the user reviews I'd
read for Norton and McAfee, and was looking for something better.

What I did have running was Zone Alarm, which alerted me that MSHTA.exe
was trying to make an outbound connection. I denied the connection and
closed all instances of IE. I also killed any process I couldn't
immediately identify, and unplugged my computer from the cable modem.

After a period where I saw there was no unusual process or disk activity
(which I admit is very subjective), I reconnected to the Internet with
the goal of running Symantec's online virus and trojan scan. When I
opened IE, my home page had changed to one that looked like MSN, but was
actually a frameset at "www.browser-page.com". I chaged it back, and
it's stayed that way through several restarts.

I ran both Symantec's and McAfee's online scans, and neither found any
viruses or trojans in my system or data files. I checked the Registry
under all the instances of \software\Microsoft\windows\currentversion
\run\ and similar, and there's no evidence of bogus background tasks or
services.

I've since applied the cumulative security update (MS04-004) for IE 6.

>From what I understand of MSHTA, there's no real limit on what the
script can do, especially when running in a privileged context. Setting
that worst-case scenario aside, what are some of the more common
scenarios when exploiting this vulnerabilty?

Relevant Pages

  • SecurityFocus Microsoft Newsletter #83
    ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft IIS CodeBrws.ASP Source Code Disclosure Vulnerability ... Microsoft Internet Explorer History List Script Injection ... Microsoft Windows 2000 Lanman Denial of Service Vulnerability ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #84
    ... The most critical piece of vulnerability assessment is remediation. ... MICROSOFT VULNERABILITY SUMMARY ... IcrediBB Script Injection Vulnerability ... WorkforceROI XPede Unprotected Administrative Facilities... ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #91
    ... SecurityFocus Microsoft Newsletter #91 ... Multiple Bugzilla Security Vulnerabilities ... Geeklog pid CGI Variable SQL Injection Vulnerability ... Geeklog Calendar Event Form Script Injection Vulnerability ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #109
    ... MICROSOFT VULNERABILITY SUMMARY ... PHPRank Banner Script Code Injection Vulnerability ... PHPNuke Multiple Script Code Filtering Vulnerabilities ...
    (Focus-Microsoft)
  • HP Web JetAdmin vulnerabilities.
    ... this vulnerability is not a critical risk. ... Luckily these directories do not have execute permissions but, this script, ... create files in the Administrators startup folder. ... it may be possible to directly inject the hts scripting ...
    (Bugtraq)