Microsoft Message Queuing Service NULL Pointer Dereference Local Privilege Escalation Vulnerability

Bugtraq ID:	35969
Class:	Input Validation Error
CVE:	CVE-2009-1922
Remote:	No
Local:	Yes
Published:	Aug 11 2009 12:00AM
Updated:	Aug 21 2009 03:46PM
Credit:	Nikita Tarakanov of Positive Technologies Research Team
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP2 Microsoft Windows Vista x64 Edition 0 Microsoft Windows Vista Ultimate 64-bit edition 0 Microsoft Windows Vista Home Premium 64-bit edition 0 Microsoft Windows Vista Home Basic 64-bit edition 0 Microsoft Windows Vista Enterprise 64-bit edition 0 Microsoft Windows Vista Business 64-bit edition 0 Microsoft Windows Vista Ultimate Microsoft Windows Vista Home Premium Microsoft Windows Vista Home Basic Microsoft Windows Vista Enterprise Microsoft Windows Vista Business Microsoft Windows Vista 0 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4
Not Vulnerable:

Microsoft Message Queuing Service NULL Pointer Dereference Local Privilege Escalation Vulnerability

The Microsoft Message Queuing service is prone to a local privilege-escalation vulnerability because it fails to adequately handle user-supplied input.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploits will cause a denial of service.

Microsoft Message Queuing Service NULL Pointer Dereference Local Privilege Escalation Vulnerability

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.

Microsoft Message Queuing Service NULL Pointer Dereference Local Privilege Escalation Vulnerability

Solution:
Microsoft released an update and an advisory. Please see the references for more information.


Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=93490aa7-9985 -4658-b0d7-88fb3f27ada0

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=ad55c653-ee6b -4c92-b7f4-3923bb916546

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=93490aa7-9985 -4658-b0d7-88fb3f27ada0

Microsoft Windows Vista Home Basic

• Microsoft Security Update for Windows Vista (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=00afd94c-b483 -4155-884f-b617acca6e7d

Microsoft Windows Vista Home Premium

• Microsoft Security Update for Windows Vista (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=00afd94c-b483 -4155-884f-b617acca6e7d

Microsoft Windows Vista Enterprise

• Microsoft Security Update for Windows Vista (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=00afd94c-b483 -4155-884f-b617acca6e7d

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=12e6be68-dc87 -450e-927b-3c9b6873eb13

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=8ed8bad7-2885 -452c-9c34-3982cd498be8

Microsoft Windows Vista Ultimate

• Microsoft Security Update for Windows Vista (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=00afd94c-b483 -4155-884f-b617acca6e7d

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=52f59c56-2aba -4626-a90e-311e0e73c813

Microsoft Windows Vista x64 Edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=a0c698aa-a913 -4981-8798-6bbb8cacfb86

Microsoft Windows Vista 0

• Microsoft Security Update for Windows Vista (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=00afd94c-b483 -4155-884f-b617acca6e7d

Microsoft Windows Vista Business

• Microsoft Security Update for Windows Vista (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=00afd94c-b483 -4155-884f-b617acca6e7d

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=2f77ef7b-54f8 -4260-b6a6-d62a0f85ef45

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=8ed8bad7-2885 -452c-9c34-3982cd498be8

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=2f77ef7b-54f8 -4260-b6a6-d62a0f85ef45

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=2f77ef7b-54f8 -4260-b6a6-d62a0f85ef45

Microsoft Windows 2000 Professional SP4

• Microsoft Security Update for Windows 2000 (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=8ed8bad7-2885 -452c-9c34-3982cd498be8

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=93490aa7-9985 -4658-b0d7-88fb3f27ada0

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Windows 2000 (KB971032)
  http://www.microsoft.com/downloads/details.aspx?familyid=8ed8bad7-2885 -452c-9c34-3982cd498be8

Microsoft Message Queuing Service NULL Pointer Dereference Local Privilege Escalation Vulnerability

References:

• Microsoft Windows Homepage (Microsoft )
  
• [PT-2008-09] Microsoft Windows MSMQ Privilege Escalation Vulnerability ("Valery Marchuk" )
  
• (PT-2008-09) Positive Technologies Security Advisory (Positive Technologies)
  
• Microsoft Security Bulletin MS09-040 (Microsoft)