How to protect Windows from the new MHTML zero-day hole

On Friday, Microsoft warned of a new zero-day bug affecting all versions of Windows that could allow remote code execution if users clicked on malicious links. It also released some guidance on how to determine if your Windows machines are vulnerable and how to turn off MHTML, the offending protocol that allows the attack.

Here’s the link: More information about the MHTML Script Injection vulnerability

Microsoft explains that this is a Windows hole, even though the tool used to cause the attack is Internet Explorer. Internet Explorer and Opera are the only two browsers that natively support MHTML, a format used to combine items that are typically external links (such as images, Flash animations, Java applets, audio files) with HTML in a single file, Wikipedia explains.

All versions of Windows are affected. Turning off MHTML apparently only has one side affect, that some ActiveX scripts in MHT files would be stopped. Microsoft said it is working with Google and others to develop and deploy a server-side fix.

Updated 2/1/2011: You can block MHTML in two ways. If you are a Windows user, working on one machine, you can use Microsoft’s Fix-it tool that will turn off MHTML for you on your PC. Here is the link to the Fix-it tool (it includes a link to an uninstall). Your second option is to directly edit the Windows registry. This would be the preferred method if you are an enterprise managing large numbers of clients. Microsoft has shared the code that will edit the registry, which you can then push out to the enterprise Windows PCs through Group Policy.

For your convenience, here is the registry information and the information from the TechNet article on how to test your system and ensure your lockdown of the protocol has worked.

To lockdown the MHTML protocol, paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension.

For 32-bit editions of Microsoft Windows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMAINFeatureControlFEATURE_PROTOCOL_LOCKDOWN]

“explorer.exe”=dword:00000001

“iexplore.exe”=dword:00000001

“*”=dword:00000001

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols1]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols2]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols3]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols4]

“mhtml”=”mhtml”

For 64-bit editions of Microsoft Windows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMAINFeatureControlFEATURE_PROTOCOL_LOCKDOWN]

“explorer.exe”=dword:00000001

“iexplore.exe”=dword:00000001

“*”=dword:00000001

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols1]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols2]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols3]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols4]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerMAINFeatureControlFEATURE_PROTOCOL_LOCKDOWN]

“explorer.exe”=dword:00000001

“iexplore.exe”=dword:00000001

“*”=dword:00000001

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols]

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols1]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols2]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols3]

“mhtml”=”mhtml”

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet SettingsRestrictedProtocols4]

“mhtml”=”mhtml”

You can apply this .reg file to individual systems by double-clicking it. You can also apply it across domains by using Group Policy.

How can I test that a client system is protected?

Here are the steps to set up a test to ensure that a machine on which the workaround is enabled is protected from this vulnerability.

Step 1: Create the test.mht with the following content:

From: "Test"
Subject: Date: Mon, 1 Jan 1111 11:11:11 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-MimeOLE: Produced By Microsoft MimeOLE V6.1.7600.16543

=EF=BB=BF

test MHTML protocol  
Step 2: Upload the test.mht to a web server.
 
Before applying the workaround, when you navigate to Error! Hyperlink reference not valid., the following screen pops up:
 
 
As shown, the script within MHTML content is running.
 
After applying the workaround and restarting IE, when you navigate to Error! Hyperlink reference not valid., the following screen pops up:
 
 
The information bar indicates that the MHTML protocol is locked down so the script is not allowed to run.