Win-XP Help Center request wipes your HD

[Jeremy Fowler]

http://www.theregister.co.uk/content/4/27074.html

Win-XP Help Center request wipes your HD
By Thomas C Greene in Washington
Posted: 11/09/2002 at 13:15 GMT

A malicious Win-XP Help Center request can easily and silently delete the
contents of any directory on your Windows machine, we've learned. Worse, MS has
rolled the fix silently into SP1 without making a public announcement. A good
sketch of the problem in English, along with a harmless self-test, can be found
here, thanks to Mike at http://unity.skankhouse.org, who did some tinkering
after noticing a tip on a BBS.

Another, slightly earlier, mention comes from VSAntivirus, but the page,
unfortunately, is en español, though there are some handy screen shots in their
bulletin.

The hole was discovered by Shane Hird of Distributed Systems Technology Centre,
who first reported it to MS on 25 June 2002. His bulletin, dated 15 August,
offers the most detailed view of the problem. He suggests that fellow bug
hunters look more deeply into the Help Center and its mysterious powers, since
requests can remotely open files with elevated privileges. He offers a few hints
about where one might start probing.

To verify the exploit all you need to do is pop the following request into any
address bar (IE, Win Explorer, etc):
hcp://system/DFS/uplddrvinfo.htm?file://c:test* and the directory 'test' will
be emptied after a couple of Help Center 'wizard' pages pop up uselessly to
distract you.

The example works as advertised, so anyone wanting to play with it should create
a test directory with copies of files. Of course you can delete your entire root
directory with this approach if you so choose. Or someone else's.

The exploit is extremely dangerous because it looks to the casual user just like
a URL, and can be sent in an e-mail or set up as a link on a Web page. Promising
heaps of free pr0n in a busy IRC channel would also likewise be effective.

To get rid of the vulnerability, you have two choices. You can install XP's new
SP1, which will give Billg remote root privileges on your box by virtue of his
new, Trojan EULA (and silently re-enable some services you may have disabled
like 'automatic update'); or you can just go to
C:WindowsPCHEALTHHELPCTRSYSTEMDFS and find the file uplddrvinfo.htm. This
you can simply delete or rename. But beware of installing MS patches later on:
these have a funny tendency to restore files and settings outside their
immediate purview, back to Redmond defaults.

To check it out I did a clean install of XP and verified the exploit on a virgin
image. I then installed all of the XP patches and updates except SP1, and it
still worked. So SP1 is the only 'official' means of fixing the hole. It's not
otherwise been dealt with. Those who object to the SP1 EULA on moral grounds
will have to delete or rename uplddrvinfo.htm, and do a search for it after
subsequent patching to verify that it's still gone.

Problems with the XP Help Center have been known for some time, at least since
November 2001, when this exploitable buffer overflow was first reported. Now the
issue has finally been fixed, in the background, with no announcement from
Redmond. This means that any XP user who doesn't install SP1, and who never
hears of the flaw, will remain vulnerable.

Redmond's handling of the issue is appalling. Apparently, 'Trustworthy
Computing' means never having to say you screwed up. ®