{"vuid":"VU#683612","idnumber":"683612","name":"Microsoft Hyperlink Object Library buffer overflow","keywords":["Microsoft","Hyperlink Object Library","remote code execution","malformed function","hyperlinks","ms06-aug","hlink.dll"],"overview":"A vulnerability in Microsoft Hyperlink Object Library may allow a remote attacker to execute arbitrary code on an affected system.","clean_desc":"The Hyperlink Object Library is a collection of application programming interfaces that provide functionality for handling hyperlinks. The Microsoft Hyperlink Object Library contains a buffer overflow vulnerability that may allow a remote attacker to execute arbitrary code. A remote attacker can exploit the vulnerability by crafting a malicious hyperlink embeded into a Microsoft Office file or e-mail message. If a user opens the malicious hyperlink, arbitrary code can be executed. Once the remote attacker has successfully exploited this vulnerability, they can gain the same user rights as the local user. Microsoft's bulletin states that the following Windows operating systems are affected by this vulnerability: Microsoft Windows 2000 Service Pack 4\nMicrosoft Windows XP Service Pack 1 and Service Pack 2\nMicrosoft Windows XP Professional x64 Edition\nMicrosoft Windows Server 2003 and Service Pack 1\nMicrosoft Windows Server 2003 for Itanium-based Systems and Service Pack 1\nMicrosoft Windows Server 2003 x64 Edition","impact":"A remote attacker who can successfully convince a user to open an email message or Microsoft office file and click a link may be able to execute arbitrary code and gain control of the affected system.","resolution":"Apply an update\nMicrosoft has released updates in Microsoft Security Bulletin MS06-050 to addess this issue.","workarounds":"Workarounds Microsoft lists the following workarounds* for this vulnerability: Modify the Access Control List to deny access to Hlink.dll for all users Disabling the Hlink.dll registry key can protect the affected system from attempts to exploit this vulnerability. By disabling the Hlink.dll registry key, hyperlinks embedded in Microsoft Office documents cannot be edited or opened. Click Start, click Run, and type cacls %windir%\\system32\\hlink.dll /d everyone, and click ok Modify the Access Control List to disable the HLINK registry key Modifying the HLINK registry key in the Windows registry will help prevent the exploitation of this vulnerability. By modifying the HLINK registry key, hyperlinks embedded in Microsoft Office documents cannot be edited or opened. Please see the Microsoft Security Bulletin MS06-050 for further details and cautions regarding use of the Registry Editor. For Windows 2000\nClick Start, click Run, and type regedit32, click OK\nExpand HKEY_CLASSES_ROOT, expand CLSID, and click 79eac9d0-baf9-11ce-8c82-00aa004ba90b \nClick Security, and then click Permissions\nUncheck the Allow Inheritable Permissions from the parent to propagate to this object check box. If asked to select from Copy, Remove, or Cancel; select Remove and then click OK. An alert will be displayed that no one will be able to access this registry key. Click Yes. For Windows XP Service Pack 1 or Later\nClick Start, click Run, and type regedit, click OK\nExpand HKEY_CLASSES_ROOT, expand CLSID, and click 79eac9d0-baf9-11ce-8c82-00aa004ba90b \nClick Security, and then click Permissions\nClick Advanced\nUncheck the Inherit from parent the permission entried that apply to child objects. Include these with entries explicitly defined here. check box. If asked to select from Copy, Remove, or Cancel; select Remove and then click OK. An alert will be displayed that no one will be able to access this registry key. Click Yes, and then click OK to close the Permissions for 79eac9d0-baf9-11ce-8c82-00aa004ba90b dialog box. Read email messages in plain text Open only hyperlinks in Microsoft Office documents that come from trusted sources. * Note that these workarounds do NOT fix the underlying vulnerability but will help block known methods of attack.","sysaffected":"","thanks":"Thanks to Microsoft Security for reporting this vulnerability in Microsoft Security Bulletin \nMS06-050 Microsoft, in turn, thanks Steve Tai of CSC Australia Pty Limited for reporting the vulnerability to them.","author":"This document was written by Katie Washok.","public":["h","t","t","p",":","/","/","w","w","w",".","m","i","c","r","o","s","o","f","t",".","c","o","m","/","t","e","c","h","n","e","t","/","s","e","c","u","r","i","t","y","/","b","u","l","l","e","t","i","n","/","m","s","0","6","-","0","5","0",".","m","s","p","x"],"cveids":["CVE-2006-3438"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-08-08T17:51:31Z","publicdate":"2006-08-08T00:00:00Z","datefirstpublished":"2006-08-08T22:07:53Z","dateupdated":"2006-08-08T22:08:05Z","revision":23,"vrda_d1_directreport":"0","vrda_d1_population":"4","vrda_d1_impact":"4","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"15","cam_impact":"17","cam_easeofexploitation":"8","cam_attackeraccessrequired":"15","cam_scorecurrent":"8.60625","cam_scorecurrentwidelyknown":"11.475","cam_scorecurrentwidelyknownexploited":"22.95","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":8.60625,"vulnote":null}