CVE-2010-1885
CRITICALCVSS Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
Lifecycle Timeline
3Description
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
Analysis
Microsoft Windows Help and Support Center in XP and Server 2003 contains a URL validation bypass in the HCP protocol handler. The MPC::HexToNum function mishandles escape sequences, allowing attackers to bypass the trusted documents whitelist and execute arbitrary commands via crafted hcp:// URLs.
Technical Context
The hcp:// protocol handler includes a fromHCP security check that restricts which help documents can be opened. The MPC::HexToNum function in helpctr.exe fails to properly handle malformed percent-encoded sequences, allowing attackers to craft URLs that bypass the whitelist check. Combined with the ability to invoke scripting within help documents, this enables arbitrary command execution.
Affected Products
['Microsoft Windows XP SP2/SP3', 'Microsoft Windows Server 2003 SP2', 'Microsoft Windows XP Professional x64']
Remediation
Upgrade from Windows XP/Server 2003 to a supported operating system. If legacy systems cannot be upgraded, unregister the HCP protocol handler via registry modification. Implement network-level controls to block hcp:// protocol traffic.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today