-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2006.0035                  AUSCERT Advisory

                                   [Win]
                     WinSCP URL handler vulnerability
                               14 June 2006
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              WinSCP 3.8.1 and prior
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
                      Overwrite Arbitrary Files
Access:               Remote/Unauthenticated
Member content until: Wednesday, July 12 2006


OVERVIEW:

	Computers with WinSCP 3.8.1 and prior installed may be vulnerable to
	remote compromise if users visit a malicious website containing 
	scp:// or sftp:// URLs.

	The handlers installed by WinSCP for these URLs allow command line 
	parameters to WinSCP to be included in the link. This potentially
	allows remote attackers to overwrite files or download arbitrary 
	files to the system. 
	

IMPACT:

	By downloading malicious software to the user's Startup folder, a
	remote attacker can potentially execute arbitrary code with the
	privileges of the user.


MITIGATION:

	A fixed version of WinSCP has not yet been released. System 
	administrators are advised to monitor the WinSCP website for the 
	availability of a new release. [1]

	In the meantime, the WinSCP author advises disabling these 
	URL handlers with a registry patch. [3]
	

REFERENCES:

	[1] WinSCP home page
	    http://winscp.net/eng/index.php

	[2] Original mailing list report
	    http://marc.theaimsgroup.com/?l=full-disclosure&m=115003144007087&w=2

	[3] Registry patch disabling handlers
	    http://winscp.net/forum/viewtopic.php?p=11628#11628


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRI+53yh9+71yA2DNAQJv0wP/er/YH5UlW14eHI/uhXXo1WOoDmp1p6ZF
ghTHfx7cg+jHu4WHWGNRB55a8SIqX0WY1J8AtyY4WkF/w3vDpLh0LO/AqrC49F/r
w5xVuwz2YADM07xloFlJ3RO1PpSN9M9Nwf7aHw/r1HhZajpUw/W8IeQqs2rdpQiS
LD6RYU2gL1A=
=L0fr
-----END PGP SIGNATURE-----