The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Vulnerability in Win 32 API Allows Code Execution (MS07-035)
------------------------------------------------------------------------
SUMMARY
This critical security update resolves a privately reported vulnerability
in a Win32 API. This vulnerability could allow remote code execution or
elevation of privilege if the affected API is used locally by a specially
crafted application. Therefore applications that use this component of the
Win32 API could be used as a vector for this vulnerability. For example,
Internet Explorer uses this Win32 API function when parsing specially
crafted Web pages.
DETAILS
Vulnerable Systems:
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=3918ac76-ebb6-4886-9a9e-808eafb96b1b>
Windows 2000 Service Pack 4 - Remote Code Execution - Critical (MS06-051)
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=27c7f1b9-2d1d-40cb-ad7e-bfedb6156a9c>
Windows XP Service Pack 2 - Remote Code Execution - Critical (MS06-051)
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=0ba12191-1e6f-443b-9150-7ab8b2deb7c2>
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition
Service Pack 2 - Remote Code Execution - Critical (MS06-051)
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb-4bbc-8fa0-af2f939d2610>
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 -
Remote Code Execution - Critical (MS06-051)
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=170473d8-6bb1-4fbd-8494-a059dbfdf182>
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service
Pack 2 - Remote Code Execution - Critical (MS06-051)
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=f5e45e3c-4cac-41a5-99f7-42c2c2c73e99>
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003
with SP2 for Itanium-based Systems - Remote Code Execution - Critical (MS06-051)
Immune Systems:
* Windows Vista
* Windows Vista x64 Edition
Win32 API Vulnerability - CVE-2007-2219
A remote code execution vulnerability exists in the way that the Win32 API
validates parameters. An attacker could exploit the vulnerability by
constructing a specially crafted Web page that could potentially allow
remote code execution if a user viewed the Web page. An attacker who
successfully exploited this vulnerability could take complete control of
an affected system.
To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2219>
CVE-2007-2219.
Mitigating Factors for Win32 API Vulnerability - CVE-2007-2219
Mitigation refers to a setting, common configuration, or general
best-practice, existing in a default state, that could reduce the severity
of exploitation of a vulnerability. The following mitigating factors may
be helpful in your situation:
* In a Web-based attack scenario, an attacker could host a Web site that
contains a Web page that is used to exploit this vulnerability. In
addition, Web sites that accept or host user-provided content or
advertisements could contain specially crafted content that could exploit
this vulnerability. In all cases, however, an attacker would have no way
to force users to visit these Web sites. Instead, an attacker would have
to convince users to visit the Web site, typically by getting them to
click a link in an e-mail message or Instant Messenger message that takes
users to the attacker's Web site.
* An attacker who successfully exploited this vulnerability could gain
the same user rights as the local user. Users whose accounts are
configured to have fewer user rights on the system could be less impacted
than users who operate with administrative user rights.
Workarounds for Win32 API Vulnerability - CVE-2007-2219
Workaround refers to a setting or configuration change that does not
correct the underlying vulnerability but would help block known attack
vectors before you apply the update. Microsoft has tested the following
workarounds and states in the discussion whether a workaround reduces
functionality:
Read e-mail messages in plain text format to help protect yourself from
the HTML e-mail attack vector
You can help protect yourself against this vulnerability by changing your
e-mail settings to read e-mail messages in plain text using Outlook 2002
and later, Outlook Express 6 and later, or Windows Mail. For information
in Outlook, search plain text in Help and review Read messages in plain
text. In Outlook Express, search plain text in Help and review
Reducing your risk of getting e-mail viruses. In Windows Mail, search
plain text in Help and review Security and privacy in Windows Mail.
Impact of Workaround: E-mail messages that are viewed in plain text format
will not contain pictures, specialized fonts, animations, or other rich
content. Additionally:
* The changes are applied to the preview pane and to open messages.
* Pictures become attachments so that they are not lost.
* Because the message is still in Rich Text or HTML format in the store,
the object model (custom code solutions) may behave unexpectedly.
ADDITIONAL INFORMATION
The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/Bulletin/MS07-035.mspx>
http://www.microsoft.com/technet/security/Bulletin/MS07-035.mspx
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
