[NT] Cumulative Security Update of Outlook Express (MS05-030)

• Previous message: SecuriTeam: "[NT] Cumulative Security Update for Internet Explorer (MS05-025)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 15 Jun 2005 10:26:53 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Cumulative Security Update of Outlook Express (MS05-030)
------------------------------------------------------------------------

SUMMARY

A remote code execution vulnerability exists in Outlook Express when it is
used as a newsgroup reader. An attacker could exploit the vulnerability by
constructing a malicious newsgroup server that could that potentially
allow remote code execution if a user queried the server for news. An
attacker who successfully exploited this vulnerability could take complete
control of an affected system. However, user interaction is required to
exploit this vulnerability.

DETAILS

Affected Software:
 * Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000
Service Pack 4
 * Microsoft Windows XP Service Pack 1
 * Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium):
 * Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
 * Microsoft Windows Server 2003 for Itanium-based Systems
 * Microsoft Windows Server 2003

Affected Components:
 * Outlook Express 5.5 Service Pack 2 on Microsoft Windows 2000 Service
Pack 3 and on Microsoft Windows 2000 Service Pack 4:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=a6932151-2ae2-4c6e-861a-6ff5bde61191> Download the Update

 * Outlook Express 6 Service Pack 1 on Microsoft Windows 2000 Service Pack
3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows XP
Service Pack 1:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=89e4d8ee-4d8e-4660-a53d-28502b3d2518> Download the update

 * Outlook Express 6 Service Pack 1 for Microsoft Windows XP 64-Bit
Edition Service Pack 1 (Itanium):
<http://www.microsoft.com/downloads/details.aspx?FamilyId=b765c0e1-f4e2-495b-aae5-2db3eeaf71bb> Download the update

 * Outlook Express 6 for Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium):
<http://www.microsoft.com/downloads/details.aspx?familyid=69901ec1-a11f-4135-9874-3698bcf7c760> Download the update

 * Outlook Express 6 for Microsoft Windows Server 2003 for Itanium-based
Systems:
<http://www.microsoft.com/downloads/details.aspx?familyid=5fc7d68b-92a6-4c03-8d88-b2501aea8da6> Download the update

 * Outlook Express 6 for Microsoft Windows Server 2003:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=d439eee9-05eb-4ecb-9e86-6259f1acaabb> Download the update

Non-Affected Software:
 * Microsoft Windows Server 2003 Service Pack 1
 * Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
 * Microsoft Windows Server 2003 x64 Edition
 * Microsoft Windows XP Professional x64 Edition
 * Microsoft Windows XP Service Pack 2

CVE Information:
Outlook Express News Reading Vulnerability -
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1213>
CAN-2005-1213

Mitigating Factors Outlook Express News Reading Vulnerability -
CAN-2005-1213:
 * In a Web-based attack scenario, an attacker would have to host a Web
site that contains a Web page that is used to exploit this vulnerability.
An attacker would have no way to force users to visit a malicious Web
site. Instead, an attacker would have to persuade them to visit the Web
site, typically by getting them to click a link that takes them to the
attacker's Web site. After they click the link, they would be prompted to
perform several actions. These actions would include setting up and
configuring Outlook Express to use the attacker s newsgroup server or a
newsgroup server that the attacker has compromised. An attack could only
occur after the attacker performed these actions.
 * An attacker who successfully exploited this vulnerability could gain
the same user rights as the local user. Users whose accounts are
configured to have fewer user rights on the system could be less impacted
than users who operate with administrative user rights.

Workarounds for Outlook Express News Reading Vulnerability -
CAN-2005-1213:
Microsoft has tested the following workarounds. These workarounds will not
correct the underlying vulnerability. However, they help block known
attack vectors. Workarounds may reduce functionality in some cases; in
such cases, the reduction in functionality is identified below.
 * Block Network News Transfer Protocol (NNTP)traffic on ports 119 TCP and
119 UDP. Only allow connections to trusted newsgroup servers through your
firewall.
 * Block the affected ports by using IPSec on the affected systems. Use
Internet Protocol security (IPSec) to help protect network communications.
Detailed information about IPSec and about how to apply filters is
available in <http://support.microsoft.com/kb/313190> Microsoft Knowledge
Base Article 313190 and <http://support.microsoft.com/kb/813878>
Microsoft Knowledge Base Article 813878.
 * Do not connect to untrusted newsgroup servers.

FAQ for NNTP Outlook Express News Reading Vulnerability - CAN-2005-1213:
What is the scope of the vulnerability?
If a user is logged on with administrative user rights, an attacker who
successfully exploited this vulnerability could take complete control of
an affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts with full user rights. Users whose
accounts are configured to have fewer user rights on the system could be
less impacted than users who operate with administrative user rights.

What causes the vulnerability?
An unchecked buffer in the NNTP Response Parsing function in Outlook
Express.
What is the Network News Transfer Protocol (NNTP) component
The NNTP component provides a service that enables the distribution,
retrieval, and posting of news articles among the Internet community. NNTP
is designed so that news articles are stored in a central database,
allowing a subscriber to select only those items that they want to read.
For more information about NNTP, see the
<http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/standard/proddocs/en-us/nntp_administration.asp?frame=true> NNTP product documentation. NNTP is defined in Request for Comment (RFC) documents <http://www.ietf.org/rfc/rfc977.txt> RFC 977 and http://www.ietf.org/rfc/rfc2980.txt.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take
complete control of the affected system.

Who could exploit the vulnerability?
Any attacker who could convince a user to connect to a malicious NNTP
server. An attacker would have no way to force a customer to connect to an
NNTP server.

How could an attacker exploit the vulnerability?
An attacker could try to exploit the vulnerability by convincing a user to
configure Outlook Express to connect to a malicious NNTP server or by
compromising an existing NNTP Server. The attacker could then create a
specially crafted response and send the response to an affected system.
The message could then cause the affected system to execute code.

What systems are primarily at risk from the vulnerability?
Users who use Outlook Express as their newsgroup reader are primarily at
risk from this vulnerability.

Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition
critically affected by this vulnerability?
No. Although Windows Millennium Edition does contain the affected
component, the vulnerability is not critical. For more information about
severity ratings, visit the following
<http://go.microsoft.com/fwlink/?LinkId=21140> Web site.

What does the update do?
The update removes the vulnerability by modifying the way that Outlook
Express, when it is used as a newsgroup reader, validates the length of a
message before it passes the message to the allocated buffer.

When this security bulletin was issued, had this vulnerability been
publicly disclosed?
No. Microsoft received information about this vulnerability through
responsible disclosure.

When this security bulletin was issued, had Microsoft received any reports
that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this
vulnerability had been publicly used to attack customers and had not seen
any examples of proof of concept code published when this security
bulletin was originally issued.

ADDITIONAL INFORMATION

The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms05-030.mspx>
http://www.microsoft.com/technet/security/bulletin/ms05-030.mspx

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NT] Cumulative Security Update for Internet Explorer (MS05-025)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]