Microsoft Active Directory Encoded LDAP String Memory Corruption Remote Code Execution Vulnerability

Bugtraq ID:	35226
Class:	Design Error
CVE:	CVE-2009-1138
Remote:	Yes
Local:	No
Published:	Jun 09 2009 12:00AM
Updated:	Jun 18 2009 02:19PM
Credit:	Joshua J. Drake of VeriSign iDefense Labs
Vulnerable:	Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service VoiceXML 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service Media Processing Server 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft Active Directory Encoded LDAP String Memory Corruption Remote Code Execution Vulnerability

Microsoft Active Directory is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Successful exploits will completely compromise the affected computer. Failed attacks will cause denial-of-service conditions.

Microsoft Active Directory Encoded LDAP String Memory Corruption Remote Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Active Directory Encoded LDAP String Memory Corruption Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=bba6e20a-0345 -46ae-a6f1-fd27fdee7c21&displaylang=en

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=bba6e20a-0345 -46ae-a6f1-fd27fdee7c21&displaylang=en

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Windows 2000 (KB969805)
  http://www.microsoft.com/downloads/details.aspx?familyid=bba6e20a-0345 -46ae-a6f1-fd27fdee7c21&displaylang=en

Microsoft Active Directory Encoded LDAP String Memory Corruption Remote Code Execution Vulnerability

References:

• Microsoft Active Directory Hexdecimal DN AttributeValue Invalid Free Vulnerabili (iDefense Labs)
  
• Microsoft Homepage (Microsoft)
  
• iDefense Security Advisory 06.11.09: Microsoft Active Directory Hexdecimal DN At (iDefense Labs )
  
• ASA-2009-214 MS09-018 Vulnerabilities in Active Directory (Avaya)
  
• Microsoft Security Bulletin MS09-018 - Critical (Microsoft)
  
• Nortel Response to Microsoft Security Bulletin MS09-018 (Nortel Networks)