Microsoft XML Core Services Race Condition Memory Corruption Vulnerability

Bugtraq ID:	21872
Class:	Race Condition Error
CVE:	CVE-2007-0099
Remote:	Yes
Local:	No
Published:	Jan 04 2007 12:00AM
Updated:	Nov 18 2008 05:04PM
Credit:	Michal Zalewski <[email protected]> discovered this vulnerability.
Vulnerable:	Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service VoiceXML 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service Media Processing Server 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Contact Center NCC 0 Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Manager Nortel Networks Contact Center Express Nortel Networks Contact Center - TAPI Server 0 Nortel Networks Contact Center - Symposium Agent 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 600r Nortel Networks CallPilot 201i Nortel Networks CallPilot 1005r Microsoft XML Core Services 3.0 HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft XML Core Services Race Condition Memory Corruption Vulnerability

Microsoft XML Core Services (MSXML) is prone to a remote memory-corruption vulnerability because of a race condition that may cause a NULL-pointer dereference, read or write operations to invalid addresses, or other memory-corruption issues.

Attackers may exploit this issue to execute arbitrary machine code in the context of the vulnerable application. Failed exploit attempts will likely crash the application.

NOTE: SANS has provided new information that lowers the impact of this vulnerability. Please see the reference section for details.

Microsoft XML Core Services Race Condition Memory Corruption Vulnerability

The following proof of concept is sufficient to demonstrate this issue by crashing the application:

http://lcamtuf.coredump.cx/iediex/iediex.html

Microsoft XML Core Services Race Condition Memory Corruption Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.


Microsoft XML Core Services 3.0

• Microsoft Security Update for Windows 2000 (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=559cd4b6-24b7 -4e60-8749-37d9b833d3eb


• Microsoft Security Update for Windows Server 2003 (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=0a0f8385-e908 -4b5f-b9bf-80b7dabfcafd


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3a65e1cd-eb4e -44b6-8868-a5a84be2cb32


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=347c8c83-4269 -4a0e-af6f-4be2e824d22b


• Microsoft Security Update for Windows Server 2008 (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=90a04164-4d02 -4ce9-b3d8-bddb1ec27618


• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4e0d1efe-70ac -459b-b330-c0149b74f520


• Microsoft Security Update for Windows Server 2008 x64 Edition (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=b7bfe3f4-835f -402c-95b5-6d49b6935308


• Microsoft Security Update for Windows Vista (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=affbc957-1867 -4bbe-924d-6f0696ae0895


• Microsoft Security Update for Windows Vista for x64-based Systems (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=b01a5f31-8c57 -4c5c-909e-b37caf0439b0


• Microsoft Security Update for Windows XP (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6ed1a087-97e2 -4283-9b53-b7b046654d08


• Microsoft Security Update for Windows XP x64 Edition (KB955069)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=1b79f220-ebfc -49c1-963b-58bbda21b6e7

Microsoft XML Core Services Race Condition Memory Corruption Vulnerability

References:

• Microsoft Internet Explorer Homepage (Microsoft)
  
• SANS on CVE-2007-0099 (SANS)
  
• Concurrency strikes MSIE (potentially exploitable msxml3 flaws) ( Michal Zalewski)
  
• ASA-2008-438 MS08-069 Vulnerabilities in Microsoft XML Core Services Could Allow (Avaya)
  
• Microsoft Security Bulletin MS08-069 (Microsoft)
  
• Nortel Response to Microsoft Security Bulletin MS08-069 (Nortel Networks)