Microsoft Windows Data Access Component DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	49026
Class:	Design Error
CVE:	CVE-2011-1975
Remote:	Yes
Local:	No
Published:	Aug 09 2011 12:00AM
Updated:	Aug 17 2011 05:50PM
Credit:	Microsoft
Vulnerable:	Microsoft Windows Server 2008 Standard Edition X64 Microsoft Windows Server 2008 Standard Edition SP2 Microsoft Windows Server 2008 Standard Edition Release Candidate Microsoft Windows Server 2008 Standard Edition R2 SP1 Microsoft Windows Server 2008 Standard Edition R2 Microsoft Windows Server 2008 Standard Edition Itanium Microsoft Windows Server 2008 Standard Edition 0 Microsoft Windows Server 2008 Standard Edition - Sp2 Web Microsoft Windows Server 2008 Standard Edition - Sp2 Storage Microsoft Windows Server 2008 Standard Edition - Sp2 Hpc Microsoft Windows Server 2008 Standard Edition - Gold Web Microsoft Windows Server 2008 Standard Edition - Gold Storage Microsoft Windows Server 2008 Standard Edition - Gold Standard Microsoft Windows Server 2008 Standard Edition - Gold Itanium Microsoft Windows Server 2008 Standard Edition - Gold Hpc Microsoft Windows Server 2008 Standard Edition - Gold Enterprise Microsoft Windows Server 2008 Standard Edition - Gold Datacenter Microsoft Windows Server 2008 Standard Edition - Gold Microsoft Windows Server 2008 R2 x64 SP1 Microsoft Windows Server 2008 R2 x64 0 Microsoft Windows Server 2008 R2 Standard Edition 0 Microsoft Windows Server 2008 R2 Itanium SP1 Microsoft Windows Server 2008 R2 Itanium 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 0 Microsoft Windows Server 2008 R2 Enterprise Edition 0 Microsoft Windows Server 2008 R2 Datacenter SP1 Microsoft Windows Server 2008 R2 Datacenter 0 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems R2 Microsoft Windows Server 2008 for x64-based Systems 0 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems R2 Microsoft Windows Server 2008 for Itanium-based Systems 0 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems 0 Microsoft Windows Server 2008 Enterprise Edition SP2 Microsoft Windows Server 2008 Enterprise Edition Release Candidate Microsoft Windows Server 2008 Enterprise Edition 0 Microsoft Windows Server 2008 Datacenter Edition SP2 Microsoft Windows Server 2008 Datacenter Edition Release Candidate Microsoft Windows Server 2008 Datacenter Edition 0 Microsoft Windows Server 2008 SP2 Beta Microsoft Windows Server 2008 - Sp2 Enterprise X64 Microsoft Windows Server 2008 R2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for x64-based Systems 0 Microsoft Windows 7 for Itanium-based Systems SP1 Microsoft Windows 7 for Itanium-based Systems 0 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for 32-bit Systems 0 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Microsoft Windows Data Access Component DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Windows is prone to an arbitrary-code-execution vulnerability that affects the Data Access Component.

Attackers can exploit this vulnerability to execute arbitrary code in the context of the user running the vulnerable application.

Microsoft Windows Data Access Component DLL Loading Arbitrary Code Execution Vulnerability

To exploit this issue, attackers must trick a user into opening a file on a remote WebDAV or SMB share.

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

Microsoft Windows Data Access Component DLL Loading Arbitrary Code Execution Vulnerability

Solution:
The vendor released an update. Please see the references for details.


Microsoft Windows 7 for 32-bit Systems SP1

• Microsoft Security Update for Windows 7 (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27 085

Microsoft Windows 7 for x64-based Systems SP1

• Microsoft Security Update for Windows 7 for x64-based Systems (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27 073

Microsoft Windows Server 2008 R2 x64 SP1

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27 087

Microsoft Windows Server 2008 R2 x64 0

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27 087

Microsoft Windows 7 for x64-based Systems 0

• Microsoft Security Update for Windows 7 for x64-based Systems (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27 073

Microsoft Windows Server 2008 R2 Itanium 0

• Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 989

Microsoft Windows Server 2008 R2 Itanium SP1

• Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26 989

Microsoft Windows 7 for 32-bit Systems 0

• Microsoft Security Update for Windows 7 (KB2560656)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27 085

Microsoft Windows Data Access Component DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Homepage (Microsoft)
  
• Microsoft Security Advisory 2269637 Released (Microsoft)
  
• Microsoft Security Bulletin MS11-059 - Important (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• MS11-059 Vulnerability in Data Access Components Could Allow Remote Code Executi (Avaya)
  
• Microsoft Security Advisory (2269637) (Microsoft)