Microsoft Active Directory Memory Leak Denial Of Service Vulnerability

Bugtraq ID:	35225
Class:	Unknown
CVE:	CVE-2009-1139
Remote:	Yes
Local:	No
Published:	Jun 09 2009 12:00AM
Updated:	Jun 18 2009 02:19PM
Credit:	Microsoft
Vulnerable:	Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service VoiceXML 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service Media Processing Server 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft Active Directory Memory Leak Denial Of Service Vulnerability

Microsoft Active Directory is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the server, denying access to legitimate users.

Microsoft Active Directory Memory Leak Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Active Directory Memory Leak Denial Of Service Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.


Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=92e7808b-92ff -449d-bb73-ee8638e9ccd1&displaylang=en

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB970437)
  http://www.microsoft.com/downloads/details.aspx?familyid=2ef3aaf0-a2a9 -4c17-99ab-a0dc3d3f7e86&displaylang=en

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=bba6e20a-0345 -46ae-a6f1-fd27fdee7c21&displaylang=en

Microsoft Windows XP Professional SP3

• Microsoft Security Update for Windows XP (KB970437)
  http://www.microsoft.com/downloads/details.aspx?familyid=cb2c9b76-0c65 -4754-9941-d45a7c74a29a&displaylang=en

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=d814ce65-a193 -4027-a6cd-106d388830a6&displaylang=en


• Microsoft Security Update for Windows Server 2003 (KB970437)
  http://www.microsoft.com/downloads/details.aspx?familyid=f6f99957-f74f -4446-8734-a468283eebae&displaylang=en

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB970437)
  http://www.microsoft.com/downloads/details.aspx?familyid=cb2c9b76-0c65 -4754-9941-d45a7c74a29a&displaylang=en

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=0d1f23c8-06eb -4996-92eb-0eb635fd6a42&displaylang=en


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB970437)
  http://www.microsoft.com/downloads/details.aspx?familyid=1a2badc7-c0a5 -4032-a009-73ebe9d76313&displaylang=en

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=bba6e20a-0345 -46ae-a6f1-fd27fdee7c21&displaylang=en

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Windows 2000 (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=bba6e20a-0345 -46ae-a6f1-fd27fdee7c21&displaylang=en

Microsoft Active Directory Memory Leak Denial Of Service Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• ASA-2009-214 MS09-018 Vulnerabilities in Active Directory (Avaya)
  
• Microsoft Security Bulletin MS09-018 - Critical (Microsoft)
  
• Nortel Response to Microsoft Security Bulletin MS09-018 (Nortel Networks)