BID:23371

Microsoft Windows UPnP Remote Stack Buffer Overflow Vulnerability

Info

Microsoft Windows UPnP Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	23371
Class:	Boundary Condition Error
CVE:	CVE-2007-1204
Remote:	Yes
Local:	No
Published:	Apr 10 2007 12:00AM
Updated:	Apr 14 2007 05:11PM
Credit:	Greg MacManus working with iDefense Labs is credited with the discovery of this issue.
Vulnerable:	Nortel Networks Multiservice Data Manager (Operator Client) 0 Nortel Networks Enterprise NMS 0 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 0 Avaya Web Messenger 0 Avaya VPNmanagerTM Console 0 Avaya Visual Vector Client 0 Avaya Visual Messenger TM 0 Avaya Unified Communications Center S3400 Avaya Unified Communication Center Avaya Speech Access 0 Avaya Outbound Contact Management 0 Avaya Operational Analyst 0 Avaya OctelDesignerTM 0 Avaya OctelAccess(r) Server 0 Avaya Network Reporting 0 Avaya Modular Messaging (MAS) Avaya IP Softphone 0 Avaya IP Agent 0 Avaya Interaction Center - Voice Quick Start 0 Avaya Interaction Center 0 Avaya Integrated Management Avaya Enterprise Management 0 Avaya CVLAN Avaya Customer Interaction Express (CIE) User Interface 1.0 Avaya Customer Interaction Express (CIE) Server 1.0 Avaya Contact Center Express 0 Avaya Computer Telephony 0 Avaya CMS Supervisor 0 Avaya Basic Call Management System Reporting Desktop server Avaya Basic Call Management System Reporting Desktop 0 Avaya Agent Access 0

Not Vulnerable:

Discussion

Microsoft Windows UPnP Remote Stack Buffer Overflow Vulnerability

Microsoft Windows is prone to a remote stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. This occurs when handling certain HTTP requests.

To exploit this issue, an attacker must be in the same network segment as the victim.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the affected service. Failed exploits attempts will likely result in denial-of-service conditions.

Exploit / POC

Microsoft Windows UPnP Remote Stack Buffer Overflow Vulnerability

The following proof of concept is available for members of the Immunity Partner's Program:

https://www.immunityinc.com/downloads/immpartners/ms07_019.tar

Solution / Fix

Microsoft Windows UPnP Remote Stack Buffer Overflow Vulnerability

Solution:
The vendor released fixes to address this issue. Please see the references for more information.

Microsoft Windows XP Media Center Edition SP2