MinorRev: Microsoft Security Bulletin MS04-035 - Vulnerability in SMTP Could Allow Remote Code Execution (885881)

From: Russ Cooper (Russ.Cooper_at_TRUSECURE.CA)
Date: 02/08/05

  • Next message: Russ Cooper: "MajorRev: v2.0 Microsoft Security Bulletin MS04-035 - Vulnerability in SMTP Could Allow Remote Code Execution (885881)" 
    Date:         Tue, 8 Feb 2005 16:06:58 -0500
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Microsoft Security Bulletin MS04-035:
    Vulnerability in SMTP Could Allow Remote Code Execution (885881)

    Bulletin URL:
    <http://www.microsoft.com/technet/security/bulletin/MS04-035.mspx>

    Reason for Revision: Bulletin updated to clarify restart requirement for Windows Server 2003 and Windows XP 64-Bit Edition Version 2003
    Version Number: 1.1
    Issued Date: Tuesday, October 12, 2004
    Revision Date: Tuesday, November 09, 2004
    Impact of Vulnerability: Remote Code Execution
    Maximum Severity Rating: Critical
    Patch(es) Replaced: None
    Caveats: The security update for Exchange 2000 Server Service Pack 3 requires, as a prerequisite, the Exchange 2000 Server Post-Service Pack 3 (SP3) Update Rollup. You must install the Update Rollup for Exchange 2000 (KB870540) before you install the security update that is provided in this security bulletin. This security update will detect whether the Update Rollup is installed. If the Update Rollup is not installed, you will be directed to the download Web site. For more information, see Microsoft Knowledge Base Article 870540. To download the prerequisite update, visit this Web site.

    Tested Software:
    Affected Software:
    ------------------
    * Microsoft Windows XP 64-Bit Edition Version 2003
    <http://tinyurl.com/6ru5u>
    * Microsoft Windows Server 2003
    <http://tinyurl.com/3w2r2>
    * Microsoft Windows Server 2003 64-Bit Edition Microsoft Exchange Server 2003 and Microsoft Exchange Server 2003 Service Pack 1 when installed on Microsoft Windows Server 2003 (uses the Windows 2003 SMTP component)
    <http://tinyurl.com/6ru5u>
    * Microsoft Exchange Server 2003 when installed on Microsoft Windows 2000 Service Pack 3 or Microsoft Windows 2000 Service Pack 4
    <http://tinyurl.com/5oej4>
    * Microsoft Exchange 2000 Server Service Pack 3
    <http://tinyurl.com/5y2w5>

    Affected Components:
    --------------------
    * Microsoft Windows XP 64-Bit Edition Version 2003 SMTP component
    * Microsoft Windows Server 2003 SMTP component
    * Microsoft Windows Server 2003 64-Bit Edition SMTP component
    * Microsoft Exchange Server 2003 Routing Engine component
    * Microsoft Exchange 2000 Server Routing Engine component

    Technical Description:
    ----------------------
    * SMTP Vulnerability - CAN-2004-0840: A remote code execution vulnerability exists in the Windows Server 2003 SMTP component because of the way that it handles Domain Name System (DNS) lookups. An attacker could exploit the vulnerability by causing the server to process a particular DNS response that could potentially allow remote code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system. The vulnerability also exists in the Microsoft Exchange Server 2003 Routing Engine component when installed on Microsoft Windows 2000 Service Pack 3 or on Microsoft Windows 2000 Service Pack 4 and in Microsoft Exchange 2000 Server Service Pack 3.

    Revision History:
    -----------------
    * v1.0 - 10/12/2004: Bulletin published
    * v1.1 - 11/9/2004: Bulletin updated to clarify restart requirement for Windows Server 2003 and Windows XP 64-Bit Edition Version 2003

    This email is sent to NTBugtraq automagically as a service to my subscribers. (v4.01.1837.24459)

    Cheers,
    Russ - Senior Scientist - TruSecure Corporation/NTBugtraq Editor 

    --
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
--
  • Next message: Russ Cooper: "MajorRev: v2.0 Microsoft Security Bulletin MS04-035 - Vulnerability in SMTP Could Allow Remote Code Execution (885881)"

    Relevant Pages

    • Alert: Microsoft Security Bulletin MS04-045 - Vulnerability in WINS Could Allow Remote Code Executio
      ... Microsoft Security Bulletin MS04-045: ... Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 ... Microsoft Windows Server 2003 64-Bit Edition ...
      (NT-Bugtraq)
    • RE: Sysprep giving error message accessing registry
      ... Microsoft Windows Server Setup Support ... | Sender: "Steve" ... | registry due to errors in it, ...
      (microsoft.public.windowsxp.setup_deployment)
    • RE: CRL Distribution point naming
      ... implementing a microsoft windows server 2003 public key infrastructure' ... you can refer to the Help of the Windows ... "To specify certificate revocation list distribution points in issued ... Thanks for using Microsoft News Group! ...
      (microsoft.public.win2000.security)
    • Re: SBS R2
      ... Microsoft Windows Server Update Services ... Microsoft SQL Server 2005 Workgroup Edition ... Exchange SP2 expands Exchange 2003 to 75 gb if you need it for storage. ... What are the new features in sbs R2 compared to the original sbs? ...
      (microsoft.public.windows.server.sbs)
    • Re: KB917283 - Security Update for Microsoft .NET Framework, Version 2
      ... This needs to be clarified Microsoft! ... trying to install since I have WinXP SP2 ... Microsoft Windows 2000 Service Pack 4 ... Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based ...
      (microsoft.public.windowsupdate)