Microsoft Windows WebDAV Mini-Redirector Heap Overflow Vulnerability

Bugtraq ID:	27670
Class:	Boundary Condition Error
CVE:	CVE-2008-0080
Remote:	Yes
Local:	No
Published:	Feb 12 2008 12:00AM
Updated:	Feb 15 2008 10:05PM
Credit:	Discovery is credited to Steven of COSEINC Vulnerability Research Lab.
Vulnerable:	Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks Enterprise NMS 0 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP2 Microsoft Windows Vista x64 Edition 0 Microsoft Windows Vista Ultimate 64-bit edition 0 Microsoft Windows Vista Home Premium 64-bit edition 0 Microsoft Windows Vista Home Basic 64-bit edition 0 Microsoft Windows Vista Enterprise 64-bit edition 0 Microsoft Windows Vista Business 64-bit edition 0 Microsoft Windows Vista Ultimate Microsoft Windows Vista Home Premium Microsoft Windows Vista Home Basic Microsoft Windows Vista Enterprise Microsoft Windows Vista Business Microsoft Windows Vista 0 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1
Not Vulnerable:

Microsoft Windows WebDAV Mini-Redirector Heap Overflow Vulnerability

A malicious server that sends a filename greater than 65536 bytes will trigger a heap overflow that can cause the kernel to crash. A video demonstrating a proof-of-concept exploit is available. Please see 'Fun with WebDAV (MS08-007)' in the references section for more information.

Microsoft Windows WebDAV Mini-Redirector Heap Overflow Vulnerability

Solution:
Microsoft has released a security bulletin to address this vulnerability. Please see the references for details.


Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=8af82f86-731c -46a0-a025-b62447e2af38

Microsoft Windows Vista Home Basic 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=45962232-af78 -42cb-bfa0-9ce7de199585

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=afeef3ec-6160 -4c1d-94bd-0bfce641d0a2

Microsoft Windows Vista Home Premium 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=45962232-af78 -42cb-bfa0-9ce7de199585

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=bca224db-fe0e -411d-a948-1c776ce974f3

Microsoft Windows Vista Home Basic

• Microsoft Security Update for Windows Vista (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ba7a2b42-1c89 -45e5-b8a6-049fa500c03a

Microsoft Windows Vista Ultimate

• Microsoft Security Update for Windows Vista (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ba7a2b42-1c89 -45e5-b8a6-049fa500c03a

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b7e725bf-7248 -4119-aca5-b7d502c09cfc

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=15b7d1c4-4ef4 -47b2-9e3b-22eafbdb90d8

Microsoft Windows Vista Business 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=45962232-af78 -42cb-bfa0-9ce7de199585

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b7e725bf-7248 -4119-aca5-b7d502c09cfc

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=afeef3ec-6160 -4c1d-94bd-0bfce641d0a2

Microsoft Windows Server 2003 SP1

• Microsoft Security Update for Windows Server 2003 (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b7e725bf-7248 -4119-aca5-b7d502c09cfc

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=afeef3ec-6160 -4c1d-94bd-0bfce641d0a2

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=bca224db-fe0e -411d-a948-1c776ce974f3

Microsoft Windows Vista Ultimate 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=45962232-af78 -42cb-bfa0-9ce7de199585

Microsoft Windows XP Professional x64 Edition

• Microsoft Security Update for Windows XP x64 Edition (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=15b7d1c4-4ef4 -47b2-9e3b-22eafbdb90d8

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b7e725bf-7248 -4119-aca5-b7d502c09cfc

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b7e725bf-7248 -4119-aca5-b7d502c09cfc

Microsoft Windows Vista Home Premium

• Microsoft Security Update for Windows Vista (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ba7a2b42-1c89 -45e5-b8a6-049fa500c03a

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=15b7d1c4-4ef4 -47b2-9e3b-22eafbdb90d8

Microsoft Windows Vista Enterprise

• Microsoft Security Update for Windows Vista (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ba7a2b42-1c89 -45e5-b8a6-049fa500c03a

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b7e725bf-7248 -4119-aca5-b7d502c09cfc

Microsoft Windows Vista Enterprise 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=45962232-af78 -42cb-bfa0-9ce7de199585

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=afeef3ec-6160 -4c1d-94bd-0bfce641d0a2

Microsoft Windows Vista Business

• Microsoft Security Update for Windows Vista (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ba7a2b42-1c89 -45e5-b8a6-049fa500c03a

Microsoft Windows Vista 0

• Microsoft Security Update for Windows Vista (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ba7a2b42-1c89 -45e5-b8a6-049fa500c03a

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=15b7d1c4-4ef4 -47b2-9e3b-22eafbdb90d8

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB946026)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=8af82f86-731c -46a0-a025-b62447e2af38

Microsoft Windows WebDAV Mini-Redirector Heap Overflow Vulnerability

References:

• Fun with WebDAV (MS08-007) (Strike Center)
  
• MRXDAV.SYS and Hex-Rays Decompiler (Ilfak Guilfanov)
  
• 2008008628: Nortel Response to Microsoft Security Bulletin MS08-007 (Nortel Networks)
  
• Microsoft Security Bulletin MS08-007 (Microsoft)