Microsoft Windows Active Accessibility DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	49976
Class:	Design Error
CVE:	CVE-2011-1247
Remote:	Yes
Local:	No
Published:	Oct 11 2011 12:00AM
Updated:	Oct 13 2011 02:50AM
Credit:	Mila Parkour, working with Anshul Kothari and Nishant Kaushik of Adobe Systems, Inc.
Vulnerable:	Microsoft Windows XP Service Pack 3 0 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Vista x64 Edition SP2 Microsoft Windows Vista x64 Edition SP1 Microsoft Windows Vista x64 Edition 0 Microsoft Windows Vista Ultimate SP2 Microsoft Windows Vista Ultimate SP1 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista Home Premium SP2 Microsoft Windows Vista Home Premium SP1 Microsoft Windows Vista Home Basic SP2 Microsoft Windows Vista Home Basic SP1 Microsoft Windows Vista Enterprise SP2 Microsoft Windows Vista Enterprise SP1 Microsoft Windows Vista Business SP2 Microsoft Windows Vista Business SP1 Microsoft Windows Server 2008 R2 x64 SP1 Microsoft Windows Server 2008 R2 Itanium SP1 Microsoft Windows Server 2008 R2 Itanium 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 0 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems R2 Microsoft Windows Server 2008 for x64-based Systems 0 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems R2 Microsoft Windows Server 2008 for Itanium-based Systems 0 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems 0 Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Sp2 X64 Microsoft Windows Server 2003 SP2 Microsoft Windows Media Center TV Pack for Windows Vista 64-bit edition 0 Microsoft Windows Media Center TV Pack for Windows Vista 32-bit edition 0 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for x64-based Systems 0 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for 32-bit Systems 0 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Microsoft Windows Active Accessibility DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Windows is prone to an arbitrary-code-execution vulnerability that affects the Active Accessibility component.

Attackers can exploit this vulnerability to execute arbitrary code in the context of the user running the vulnerable application.

Microsoft Windows Active Accessibility DLL Loading Arbitrary Code Execution Vulnerability

To exploit this issue, attackers must trick a user into opening a file on a remote WebDAV or SMB share.

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

Microsoft Windows Active Accessibility DLL Loading Arbitrary Code Execution Vulnerability

Solution:
Vendor updates are available. Please see the references for details.


Microsoft Windows 7 for 32-bit Systems SP1

• Microsoft Security Update for Windows 7 (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=02d28e59-b38f -433a-a568-e86f9d43dd42

Microsoft Windows 7 for x64-based Systems SP1

• Microsoft Security Update for Windows 7 for x64-based Systems (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=904dec69-e8b9 -4b23-a5ea-d3e7e9b9df07

Microsoft Windows Server 2008 for Itanium-based Systems SP2

• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e9930d3-ba13 -446d-bfa0-60720c48203b

Microsoft Windows Server 2008 R2 x64 SP1

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=c7bd50b7-03f1 -4ea4-ad71-d428822c62f8

Microsoft Windows Server 2008 for 32-bit Systems SP2

• Microsoft Security Update for Windows Server 2008 (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=7cd1ecec-8a3f -4cb2-833c-a177c9602ff5

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=09e178f8-2bd2 -46e1-b975-4938ee1f304d

Microsoft Windows Server 2008 for x64-based Systems R2

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=c7bd50b7-03f1 -4ea4-ad71-d428822c62f8

Microsoft Windows 7 for x64-based Systems 0

• Microsoft Security Update for Windows 7 for x64-based Systems (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=904dec69-e8b9 -4b23-a5ea-d3e7e9b9df07

Microsoft Windows Server 2008 for x64-based Systems SP2

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=456e450c-3928 -4130-8127-e4d3f482c1ca

Microsoft Windows Server 2008 R2 Itanium 0

• Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa816682-9652 -433c-b1b4-5d0bc17b6a87

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB2605295)
  http://www.microsoft.com/downloads/details.aspx?familyid=82653b8c-0e58 -440d-9702-8847f599caed

Microsoft Windows Server 2008 R2 Itanium SP1

• Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa816682-9652 -433c-b1b4-5d0bc17b6a87

Microsoft Windows Vista SP2

• Microsoft Security Update for Windows Vista (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=96b089c0-a2e7 -44cb-9fc4-9569b3993afa

Microsoft Windows 7 for 32-bit Systems 0

• Microsoft Security Update for Windows 7 (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=02d28e59-b38f -433a-a568-e86f9d43dd42

Microsoft Windows Server 2008 R2 for x64-based Systems SP1 0

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=c7bd50b7-03f1 -4ea4-ad71-d428822c62f8

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=c8fcf427-17d0 -4caa-b406-50703f980862

Microsoft Windows Vista x64 Edition SP2

• Microsoft Security Update for Windows Vista for x64-based Systems (KB2564958)
  http://www.microsoft.com/downloads/details.aspx?familyid=b79a389c-8340 -4dd2-9ab1-a0943c5a220f

Microsoft Windows Active Accessibility DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Homepage (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• ASA-2011-306 MS11-075 Vulnerability in Microsoft Active Accessibility Could Allo (Avaya)
  
• Microsoft Security Bulletin MS11-075 (Microsoft)