Microsoft Win32 API Parameter Validation Remote Code Execution Vulnerability

Bugtraq ID:	24370
Class:	Unknown
CVE:	CVE-2007-2219
Remote:	Yes
Local:	No
Published:	Apr 11 2007 12:00AM
Updated:	Jun 21 2007 10:39PM
Credit:	This issue was discovered by Billy Rios.
Vulnerable:	Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration 0 Nortel Networks Contact Center - TAPI Server 0 Nortel Networks Contact Center - Symposium Agent 0 Nortel Networks Contact Center - CCT 0 Nortel Networks Contact Center - Agent Desktop Display 0 Nortel Networks Contact Center Nortel Networks Centrex IP Client Manager 8.0 Nortel Networks Centrex IP Client Manager 7.0 Nortel Networks Centrex IP Client Manager 9.0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 702t Nortel Networks CallPilot 201i Nortel Networks CallPilot 200i Nortel Networks CallPilot 1002rp Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP2 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Beta 1 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Beta 1 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Terminal Services SP4 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4 HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0 Avaya CIE 1.0
Not Vulnerable:	Microsoft Windows Vista x64 Edition 0 Microsoft Windows Vista 0

Microsoft Win32 API Parameter Validation Remote Code Execution Vulnerability

The Microsoft Win32 API is prone to remote code execution.

An attacker could exploit this issue to execute code in the context of the user visiting a malicious webpage.

Microsoft Win32 API Parameter Validation Remote Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Microsoft Win32 API Parameter Validation Remote Code Execution Vulnerability

Solution:
Microsoft has released security advisory MS07-035 to address this issue in supported versions of affected applications. Please see the referenced advisory for more information.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB935839)
  Microsoft Windows Server 2003 x64 Edition update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=f5e45e3c-4cac -41a5-99f7-42c2c2c73e99&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB935839)
  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=27c7f1b9-2d1d -40cb-ad7e-bfedb6156a9c&displaylang=en

Microsoft Windows Server 2003 Itanium SP1

• Cuyahoga Security Update for Windows Server 2003 for Itanium-based Systems (KB935839) - English
  Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems update (KB935839) - English
  http://www.microsoft.com/downloads/details.aspx?FamilyId=170473d8-6bb1 -4fbd-8494-a059dbfdf182&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows Server 2003 Itanium 0

• Cuyahoga Security Update for Windows Server 2003 for Itanium-based Systems (KB935839) - English
  Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems update (KB935839) - English
  http://www.microsoft.com/downloads/details.aspx?FamilyId=170473d8-6bb1 -4fbd-8494-a059dbfdf182&displaylang=en

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB935839)
  Microsoft Windows 2000 Service Pack 4 Update for (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3918ac76-ebb6 -4886-9a9e-808eafb96b1b&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Cuyahoga Security Update for Windows Server 2003 for Itanium-based Systems (KB935839) - English
  Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems update (KB935839) - English
  http://www.microsoft.com/downloads/details.aspx?FamilyId=170473d8-6bb1 -4fbd-8494-a059dbfdf182&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB935839)
  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=27c7f1b9-2d1d -40cb-ad7e-bfedb6156a9c&displaylang=en

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Windows 2000 (KB935839)
  Microsoft Windows 2000 Service Pack 4 Update for (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3918ac76-ebb6 -4886-9a9e-808eafb96b1b&displaylang=en

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB935839)
  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=27c7f1b9-2d1d -40cb-ad7e-bfedb6156a9c&displaylang=en

Microsoft Windows Server 2003 Web Edition

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows XP Professional x64 Edition

• Microsoft Security Update for Windows XP x64 Edition (KB935839)
  Microsoft Windows XP Professional x64 Edition update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=0ba12191-1e6f -443b-9150-7ab8b2deb7c2&displaylang=en

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Cuyahoga Security Update for Windows Server 2003 for Itanium-based Systems (KB935839) - English
  Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems update (KB935839) - English
  http://www.microsoft.com/downloads/details.aspx?FamilyId=170473d8-6bb1 -4fbd-8494-a059dbfdf182&displaylang=en

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows Server 2003 Standard Edition

• Microsoft Security Update for Windows Server 2003 (KB935839)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d554dff4-bcfb -4bbc-8fa0-af2f939d2610&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Cuyahoga Security Update for Windows Server 2003 for Itanium-based Systems (KB935839) - English
  Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems update (KB935839) - English
  http://www.microsoft.com/downloads/details.aspx?FamilyId=170473d8-6bb1 -4fbd-8494-a059dbfdf182&displaylang=en

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB935839)
  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=27c7f1b9-2d1d -40cb-ad7e-bfedb6156a9c&displaylang=en

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB935839)
  Microsoft Windows Server 2003 x64 Edition update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=f5e45e3c-4cac -41a5-99f7-42c2c2c73e99&displaylang=en

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB935839)
  Microsoft Windows 2000 Service Pack 4 Update for (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3918ac76-ebb6 -4886-9a9e-808eafb96b1b&displaylang=en

Microsoft Windows 2000 Professional SP4

• Microsoft Security Update for Windows 2000 (KB935839)
  Microsoft Windows 2000 Service Pack 4 Update for (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3918ac76-ebb6 -4886-9a9e-808eafb96b1b&displaylang=en

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB935839)
  Microsoft Windows Server 2003 x64 Edition update (KB935839)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=f5e45e3c-4cac -41a5-99f7-42c2c2c73e99&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Cuyahoga Security Update for Windows Server 2003 for Itanium-based Systems (KB935839) - English
  Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems update (KB935839) - English
  http://www.microsoft.com/downloads/details.aspx?FamilyId=170473d8-6bb1 -4fbd-8494-a059dbfdf182&displaylang=en

Microsoft Win32 API Parameter Validation Remote Code Execution Vulnerability

References:

• Microsoft Windows Homepage (Microsoft )
  
• Microsoft Windows Win32 API fails to properly validate function parameters (US-CERT)
  
• Vulnerability in Win 32 API Could Allow Remote Code Execution (935839) (Microsoft)
  
• [SECURITY ADVISORY ] Centrex IP Client Manager (CICM) response to Microsoft June (Nortel Networks)
  
• ASA-2007-260 MS07-035 Vulnerability in Win32 API Could Allow Remote Code Executi (Avaya)
  
• Nortel Security Advisory 2007008071: Nortel Response to Microsoft Security Bulle (Nortel Networks )