Microsoft Window Utility Manager Local Elevation of Privileges July 13, 2004 Credit: This vulnerability was researched and discovered by Cesar Cerrudo. Risk Level: High Summary: A local elevation of privileges exists in the Windows Utility Manager which allows any user to take complete control over the operating system. This vulnerability affects the Windows 2000 operating system family. Details: The Microsoft Windows 2000 operating system family supports a feature called Accessibility Options. Accessibility Options are a series of assistive technologies within Windows that help users with disabilities access the functions of the operating system. They can be enabled or disabled using shortcuts built into the operating system or through the Accessibility Utility Manager. The Accessibility Utility Manager allows users to start, stop, or monitor accessibility programs such as Microsoft Magnifier, Narrator, On-Screen Keyboard, etc... The Utility Manager can be invoked by pressing <Windows key>+U or, if the user is an Administrator, by executing "utilman.exe /start" from the command line. The Utility Manager runs as a Windows service enabled by default. When executed it runs within the interactive desktop with Local System privileges. Utility Manager supports context sensitive help which was accessed by clicking the "?" on the title bar of the Utility Manager window and then clicking an object or by pressing F1 key after selecting an object. To display the context sensitive help, Utility Manager loaded winhlp32.exe. However it did not drop System privileges when doing so meaning that winhlp32.exe was executed under the Local System account. Microsoft fixed this vulnerability with patch MS04-011. The patch failed to fix the problem because it only removed the context sensitive help from the Utility Manager GUI preventing help from being invoked from the main screen. However, the patch did not remove/disable the functionality used by the application to launch the context sensitive help (see ¹ for more details). Utility Manager continues to load winhlp32.exe without dropping privileges meaning that winhlp32.exe is still run under Local System account. A user need only to send several Windows messages and winhlp32.exe will be launched. From there, the user can open any file as a Local System account. To exploit the vulnerability, an attacker would need only to run the following code: //get window handle lHandle=FindWindow(NULL, "Utility Manager"); //send right click on the app button in the taskbar or Alt+Space Bar PostMessage(lHandle,0x313,NULL,NULL); Sleep(100); //send WM_COMMANDHELP 0x0365 lParam must be<>NULL SendMessage(lHandle,0x365,NULL,0x1); After this code has been executed, winhlp32.exe will ask the attacker to locate the umandlg.hlp help file. The attacker can then select "Yes" and an Open dialog will be shown. The attacker can then search and select cmd.exe. The attacker will then have a shell running under Local System privileges. Note: It seems that Visual C++ MFC (Microsoft Foundation Class) (see ²) will automatically include help functionality in an application regardless of whether or not this functionality will be utilized. Therefore, when coding desktop applications that will run with elevated privileges, remove all help functionality or drop account privileges before loading the help. Links: (Previous vulnerability) http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0908 http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx http://www.microsoft.com/downloads/details.aspx?FamilyId=0692C27E-F63A-414C-B3EB-D2342FBB6C00&displaylang=en http://www.appsecinc.com/resources/alerts/general/04-0001.html (Current vulnerability) 1. http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vcmfc98/html/_mfcnotes_tn028.asp 2. http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vccore98/HTML/_core_help.3a_.f1_and_shift.2b.f1_help.asp 3. http://www.microsoft.com/technet/security/bulletin/ms04-019.mspx Workaround: Disable Utility Manager Service. Fix: http://www.microsoft.com/technet/security/bulletin/ms04-019.mspx Acknowledgement: Thanks to Brett Moore and Esteban Martinez Fayo. -- _____________________________________________ AppSecInc Team SHATTER Tel: 1-866-927-7732 E-mail: shatter@private Web: www.appsecinc.com Application Security, Inc. "Securing Business by Securing Enterprise Applications"
This archive was generated by hypermail 2.1.3 : Tue Jul 13 2004 - 19:56:42 PDT