Google Engineer Exposes Microsoft Windows Bug

Microsoft issued a security advisory June 10 after a Google engineer published attack code targeting a Windows zero-day vulnerability on the Full Disclosure message list.

The vulnerability, uncovered by Google engineer Tavis Ormandy, affects “the Windows Help and Support Center function that is delivered with Windows XP and Windows Server 2003,” Microsoft said. Other editions of the operating system are not impacted by the bug.

“Launching the Help and Support Center via an hcp:// link is normally safe and is a supported way to launch help content,” said a post on Microsoft’s Security Research & Defense blog. “This is due in part to an ‘allow list’ of safe pages that Help and Support Center checks before navigating to a passed-in page. The Google security researcher found a help page with a cross-site scripting vulnerability and also a mechanism by which to abuse the allow list functionality to access that page with an exploit querystring. Clicking on a malicious hcp:// link leverages the XSS vulnerability to circumvent helpctr.exe’s safety controls and ultimately run an arbitrary .exe installed on the machine.”

Attacks may be forthcoming

So far, Microsoft has not seen any evidence the vulnerability is being targeted in the wild. However, attacks may be forthcoming since Ormandy’s code is public.

In his Full Disclosure message, Ormandy wrote that he reported the bug to Microsoft on 5 June. His decision to publish proof-of-concept attack code and details of the bug on the web has sparked some criticism from security professionals.

Andrew Storms, director of security operations at nCircle, described Ormandy’s actions as “effectively forcing Microsoft’s hand. He used the same process on another bug he discovered earlier this year … you have to wonder if he is adding fuel to the very public fire between Microsoft and Google by continuing to draw negative attention to Microsoft’s security process.”

Google and Microsoft have engaged in some verbal sparring lately, starting with media reports that Google is dumping Windows in favour of other operating systems, in part due to security concerns. Microsoft countered with a blog post detailing some of the security features of Windows and pointing to examples of malware targeting Mac computers as well as to Yale University’s decision to halt its move to Google Gmail for security reasons.

Patch and workarounds

Microsoft said in the advisory that it is working on a patch. In the meantime, there are some workarounds given in the advisory that could help.

“The full-disclosure advisory included a hotfix tool built by the Google security researcher,” said the Microsoft Security Research & Defense blog post. “Unfortunately, it is ineffective at preventing the vulnerable code from being reached and can be easily bypassed. We recommend not counting on the Google hotfix tool for protection from the issue. The best workaround is to unregister the hcp:// protocol handler. Doing so will prevent the chain of events that leads to the code execution.”

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

Is the Digital Transformation of Businesses Complete?

Digital transformation is an ongoing journey, requiring continuous adaptation, strong leadership, and skilled talent to…

6 hours ago

Craig Wright Faces Contempt Claim Over Bitcoin Lawsuit

Australian computer scientist faces contempt-of-court claim after suing Jack Dorsey's Block and Bitcoin Core developers…

7 hours ago

OpenAI Adds ChatGPT Search Features

OpenAI's ChatGPT gets search features, putting it in direct competition with Microsoft and Google, amidst…

8 hours ago

Google Maps Steers Into Local Information With AI Chat

New Google Maps allows users to ask for detailed information on local spots, adds AI-summarised…

8 hours ago

Huawei Sees Sales Surge, But Profits Fall

US-sanctioned Huawei sees sales surge in first three quarters of 2024 on domestic smartphone popularity,…

9 hours ago

Apple Posts China Sales Decline, Ramping Pressure On AI Strategy

Apple posts slight decline in China sales for fourth quarter, as Tim Cook negotiates to…

9 hours ago