[NT] Cumulative Security Update of Outlook Express (MS05-030)
SecuriTeam <[email protected]>
| Newsgroups | gmane.comp.security.securiteam |
|---|---|
| Message-ID | <[email protected]> |
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html - - - - - - - - - Cumulative Security Update of Outlook Express (MS05-030) ------------------------------------------------------------------------ SUMMARY A remote code execution vulnerability exists in Outlook Express when it is used as a newsgroup reader. An attacker could exploit the vulnerability by constructing a malicious newsgroup server that could that potentially allow remote code execution if a user queried the server for news. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability. DETAILS Affected Software: * Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 * Microsoft Windows XP Service Pack 1 * Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium): * Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium) * Microsoft Windows Server 2003 for Itanium-based Systems * Microsoft Windows Server 2003 Affected Components: * Outlook Express 5.5 Service Pack 2 on Microsoft Windows 2000 Service Pack 3 and on Microsoft Windows 2000 Service Pack 4: <http://www.microsoft.com/downloads/details.aspx?FamilyId=a6932151-2ae2-4c6e-861a-6ff5bde61191> Download the Update * Outlook Express 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows XP Service Pack 1: <http://www.microsoft.com/downloads/details.aspx?FamilyId=89e4d8ee-4d8e-4660-a53d-28502b3d2518> Download the update * Outlook Express 6 Service Pack 1 for Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium): <http://www.microsoft.com/downloads/details.aspx?FamilyId=b765c0e1-f4e2-495b-aae5-2db3eeaf71bb> Download the update * Outlook Express 6 for Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium): <http://www.microsoft.com/downloads/details.aspx?familyid=69901ec1-a11f-4135-9874-3698bcf7c760> Download the update * Outlook Express 6 for Microsoft Windows Server 2003 for Itanium-based Systems: <http://www.microsoft.com/downloads/details.aspx?familyid=5fc7d68b-92a6-4c03-8d88-b2501aea8da6> Download the update * Outlook Express 6 for Microsoft Windows Server 2003: <http://www.microsoft.com/downloads/details.aspx?FamilyId=d439eee9-05eb-4ecb-9e86-6259f1acaabb> Download the update Non-Affected Software: * Microsoft Windows Server 2003 Service Pack 1 * Microsoft Windows Server 2003 with SP1 for Itanium-based Systems * Microsoft Windows Server 2003 x64 Edition * Microsoft Windows XP Professional x64 Edition * Microsoft Windows XP Service Pack 2 CVE Information: Outlook Express News Reading Vulnerability - <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1213> CAN-2005-1213 Mitigating Factors Outlook Express News Reading Vulnerability - CAN-2005-1213: * In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to exploit this vulnerability. An attacker would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's Web site. After they click the link, they would be prompted to perform several actions. These actions would include setting up and configuring Outlook Express to use the attacker s newsgroup server or a newsgroup server that the attacker has compromised. An attack could only occur after the attacker performed these actions. * An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Workarounds for Outlook Express News Reading Vulnerability - CAN-2005-1213: Microsoft has tested the following workarounds. These workarounds will not correct the underlying vulnerability. However, they help block known attack vectors. Workarounds may reduce functionality in some cases; in such cases, the reduction in functionality is identified below. * Block Network News Transfer Protocol (NNTP)traffic on ports 119 TCP and 119 UDP. Only allow connections to trusted newsgroup servers through your firewall. * Block the affected ports by using IPSec on the affected systems. Use Internet Protocol security (IPSec) to help protect network communications. Detailed information about IPSec and about how to apply filters is available in <http://support.microsoft.com/kb/313190> Microsoft Knowledge Base Article 313190 and <http://support.microsoft.com/kb/813878> Microsoft Knowledge Base Article 813878. * Do not connect to untrusted newsgroup servers. FAQ for NNTP Outlook Express News Reading Vulnerability - CAN-2005-1213: What is the scope of the vulnerability? If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. What causes the vulnerability? An unchecked buffer in the NNTP Response Parsing function in Outlook Express. What is the Network News Transfer Protocol (NNTP) component The NNTP component provides a service that enables the distribution, retrieval, and posting of news articles among the Internet community. NNTP is designed so that news articles are stored in a central database, allowing a subscriber to select only those items that they want to read. For more information about NNTP, see the <http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/standard/proddocs/en-us/nntp_administration.asp?frame=true> NNTP product documentation. NNTP is defined in Request for Comment (RFC) documents <http://www.ietf.org/rfc/rfc977.txt> RFC 977 and http://www.ietf.org/rfc/rfc2980.txt. What might an attacker use the vulnerability to do? An attacker who successfully exploited this vulnerability could take complete control of the affected system. Who could exploit the vulnerability? Any attacker who could convince a user to connect to a malicious NNTP server. An attacker would have no way to force a customer to connect to an NNTP server. How could an attacker exploit the vulnerability? An attacker could try to exploit the vulnerability by convincing a user to configure Outlook Express to connect to a malicious NNTP server or by compromising an existing NNTP Server. The attacker could then create a specially crafted response and send the response to an affected system. The message could then cause the affected system to execute code. What systems are primarily at risk from the vulnerability? Users who use Outlook Express as their newsgroup reader are primarily at risk from this vulnerability. Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by this vulnerability? No. Although Windows Millennium Edition does contain the affected component, the vulnerability is not critical. For more information about severity ratings, visit the following <http://go.microsoft.com/fwlink/?LinkId=21140> Web site. What does the update do? The update removes the vulnerability by modifying the way that Outlook Express, when it is used as a newsgroup reader, validates the length of a message before it passes the message to the allocated buffer. When this security bulletin was issued, had this vulnerability been publicly disclosed? No. Microsoft received information about this vulnerability through responsible disclosure. When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued. ADDITIONAL INFORMATION The original article can be found at: <http://www.microsoft.com/technet/security/bulletin/ms05-030.mspx> http://www.microsoft.com/technet/security/bulletin/ms05-030.mspx ======================================== This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected] ==================== ==================== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.