Microsoft Windows XML Core Services XSLT Buffer Overrun Vulnerability

Bugtraq ID:	20338
Class:	Boundary Condition Error
CVE:	CVE-2006-4686
Remote:	Yes
Local:	No
Published:	Oct 10 2006 12:00AM
Updated:	Oct 22 2006 05:28AM
Credit:	The vendor disclosed this issue.
Vulnerable:	Microsoft XML Parser 2.6 Microsoft XML Core Services 6.0 Microsoft XML Core Services 5.0 SP1 Microsoft XML Core Services 5.0 Microsoft XML Core Services 4.0 Microsoft XML Core Services 3.0 SP7 Microsoft XML Core Services 3.0 SP5 Microsoft XML Core Services 3.0 SP4 Microsoft XML Core Services 3.0 SP3 Microsoft XML Core Services 3.0 Microsoft SQL Server 2005 SP1 Microsoft SQL Server 2000 Client 8.0 SP3 Microsoft SQL Server 2000 SP3a Microsoft SQL Server 2000 SP3 Microsoft SQL Server 2000 SP2 Microsoft SQL Server 2000 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 Microsoft SQL Server 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003 HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I Avaya Modular Messaging (MAS) 3.0
Not Vulnerable:	Microsoft XML Core Services 2.5 SP1 Microsoft XML Core Services 2.5

Microsoft Windows XML Core Services XSLT Buffer Overrun Vulnerability

Microsoft Windows is prone to a remotely exploitable buffer-overrun condition in the XSLT implementation of XML core services.

An attacker can exploit this issue to execute arbitrary code on an unsuspecting victim's computer. This may facilitate a remote compromise.

Microsoft Windows XML Core Services XSLT Buffer Overrun Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows XML Core Services XSLT Buffer Overrun Vulnerability

Solution:
Microsoft has released security bulletin MS06-061 to address this issue. Please see the attached security bulletin for information on how to obtain fixes.


Microsoft XML Core Services 3.0 SP7

• Microsoft Security Update for Office 2003 (KB924424)
  Microsoft Office 2003 Service Pack 1 or Service Pack 2 with Microsoft XML Core Services 5.0 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8A37C111-D8E9 -4C2E-9674-169B3331491C


• Microsoft Security Update for Windows Server 2003 (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?FamilyId=09b77b2a-a4fd -46e2-af15-2385790c9ee7


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyId=31c88513-29df -475b-b9ae-a2f5c1f32a8c


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 x64 Edition
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6183a9d2-89f5 -4b25-be8b-090c6e050740


• Microsoft Security Update for Windows XP (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8a455c3b-213c -4395-87e9-9895f2b9a6ed

Microsoft XML Core Services 6.0

• Microsoft Vulnerabilities in Microsoft XML Core Services 6.0 RTM Could Allow Remote Code Execution (925673)
  Windows 2000 Service Pack 4, Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2, and Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fd513435-fa6d -407c-bedc-5fd03e5b7d6c

Microsoft XML Core Services 4.0

• Microsoft Vulnerabilities in Microsoft XML Core Services 4.0 SP2 Could Allow Remote Code Execution (925672) -
  Windows 2000 Service Pack 4, Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2, and Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=961f3c95-ec4e -4561-ab27-b3180e9139c5

Microsoft XML Parser 2.6

• Microsoft Security Update for Office 2003 (KB924424)
  Microsoft Office 2003 Service Pack 1 or Service Pack 2 with Microsoft XML Core Services 5.0 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8A37C111-D8E9 -4C2E-9674-169B3331491C


• Microsoft Security Update for Windows 2000 (KB924191) - English
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Windows 2000 Service Pack 4
  http://www.microsoft.com/downloads/details.aspx?familyid=f9d16d74-1785 -4c33-b1fc-df5258dd1089&displaylang=en


• Microsoft Security Update for Windows Server 2003 (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?FamilyId=09b77b2a-a4fd -46e2-af15-2385790c9ee7


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyId=31c88513-29df -475b-b9ae-a2f5c1f32a8c


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 x64 Edition
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6183a9d2-89f5 -4b25-be8b-090c6e050740


• Microsoft Security Update for Windows XP (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8a455c3b-213c -4395-87e9-9895f2b9a6ed


• Microsoft Security Update for Windows XP x64 Edition (KB924191) - English
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Professional x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=5593333f-bcd5 -4750-a23d-4f7fccda6493&displaylang=en

Microsoft XML Core Services 3.0 SP4

• Microsoft Security Update for Office 2003 (KB924424)
  Microsoft Office 2003 Service Pack 1 or Service Pack 2 with Microsoft XML Core Services 5.0 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8A37C111-D8E9 -4C2E-9674-169B3331491C


• Microsoft Security Update for Windows Server 2003 (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?FamilyId=09b77b2a-a4fd -46e2-af15-2385790c9ee7


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyId=31c88513-29df -475b-b9ae-a2f5c1f32a8c


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 x64 Edition
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6183a9d2-89f5 -4b25-be8b-090c6e050740


• Microsoft Security Update for Windows XP (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8a455c3b-213c -4395-87e9-9895f2b9a6ed


• Microsoft Security Update for Windows XP x64 Edition (KB924191) - English
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Professional x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=5593333f-bcd5 -4750-a23d-4f7fccda6493&displaylang=en

Microsoft XML Core Services 3.0 SP3

• Microsoft Security Update for Office 2003 (KB924424)
  Microsoft Office 2003 Service Pack 1 or Service Pack 2 with Microsoft XML Core Services 5.0 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8A37C111-D8E9 -4C2E-9674-169B3331491C


• Microsoft Security Update for Windows Server 2003 (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?FamilyId=09b77b2a-a4fd -46e2-af15-2385790c9ee7


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyId=31c88513-29df -475b-b9ae-a2f5c1f32a8c


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 x64 Edition
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6183a9d2-89f5 -4b25-be8b-090c6e050740


• Microsoft Security Update for Windows XP (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8a455c3b-213c -4395-87e9-9895f2b9a6ed

Microsoft XML Core Services 3.0

• Microsoft Security Update for Office 2003 (KB924424)
  Microsoft Office 2003 Service Pack 1 or Service Pack 2 with Microsoft XML Core Services 5.0 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8A37C111-D8E9 -4C2E-9674-169B3331491C


• Microsoft Security Update for Windows 2000 (KB924191) - English
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Windows 2000 Service Pack 4
  http://www.microsoft.com/downloads/details.aspx?familyid=f9d16d74-1785 -4c33-b1fc-df5258dd1089&displaylang=en


• Microsoft Security Update for Windows Server 2003 (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?FamilyId=09b77b2a-a4fd -46e2-af15-2385790c9ee7


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyId=31c88513-29df -475b-b9ae-a2f5c1f32a8c


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 x64 Edition
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6183a9d2-89f5 -4b25-be8b-090c6e050740


• Microsoft Security Update for Windows XP (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8a455c3b-213c -4395-87e9-9895f2b9a6ed

Microsoft XML Core Services 3.0 SP5

• Microsoft Security Update for Office 2003 (KB924424)
  Microsoft Office 2003 Service Pack 1 or Service Pack 2 with Microsoft XML Core Services 5.0 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8A37C111-D8E9 -4C2E-9674-169B3331491C


• Microsoft Security Update for Windows Server 2003 (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?FamilyId=09b77b2a-a4fd -46e2-af15-2385790c9ee7


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyId=31c88513-29df -475b-b9ae-a2f5c1f32a8c


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 x64 Edition
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6183a9d2-89f5 -4b25-be8b-090c6e050740


• Microsoft Security Update for Windows XP (KB924191)
  Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8a455c3b-213c -4395-87e9-9895f2b9a6ed

Microsoft Windows XML Core Services XSLT Buffer Overrun Vulnerability

References:

• Avaya security advisory ASA-2006-217 (Avaya)
  
• Microsoft Security Bulletin MS06-061 - Vulnerabilities in Microsoft XML Core Ser (Microsoft)
  
• Microsoft Technet Security (Microsoft)
  
• Microsoft Windows Homepage (Microsoft)