__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Vulnerability in Microsoft Agent
[Microsoft Security Bulletin MS07-020 (932168)]
April 12, 2007 12:00 GMT Number R-200
[REVISED 19 Apr 2007]
[REVISED 15 June 2007]
______________________________________________________________________________
PROBLEM: A remote code execution vulnerability exists in Microsoft Agent
in the way that it handles certain specially crafted URLs.
PLATFORM: Affected Software:
• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition and Microsoft
Windows XP Professional x64 Edition Service Pack 2
• Microsoft Windows Server 2003 and Microsoft Windows Server
2003 Service Pack 1 and Microsoft Server 2003 Service Pack 2
• Microsoft Windows Server 2003 x64 Edition with Service Pack 1
and Microsoft Windows Server 2003 x64 Edition with Service
Pack 2
• Microsoft Windows Server 2003 for Itanium-based Systems,
Microsoft Windows Server 2003 with SP1 for Itanium-based
Systems, and Microsoft Windows Server 2003 with SP2 for
Itanium-based Systems
Non-Affected Software:
• Windows Vista
• Windows Vista x64 Edition
Storage Management Appliance v2.1 Software running on Storage
Management Appliance I, II, and III
DAMAGE: Remote code execution.
SOLUTION: Upgrade to the appropriate version.
______________________________________________________________________________
VULNERABILITY The risk is HIGH. Remote code execution.
ASSESSMENT:
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/r-200.shtml
ORIGINAL BULLETIN: http://www.microsoft.com/technet/security/Bulletin/MS07-
020.mspx
ADDITIONAL LINK: Visit Hewlett-Packard's Subscription Service for:
HPSBST02208 SSRT071365 rev. 1
CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=
CVE-2007-1205
______________________________________________________________________________
REVISION HISTORY:
04/19/2007 - revised R-200 to add a link to Hewlett-Packard's Subscription
Service for HPSBST02208 SSRT071365 rev. 1 for Storage Management
Appliance v2.1 Software running on Storage Management Appliance
I, II, and III.
06/15/2007 - revised R-200 to reflect changes Microsoft has made in MS07-020 where
they removed the literal "with Service Pack 1" from all instances of
"Windows Server 2003 x64 Edition with Service Pack 1".
[***** Start Microsoft Security Bulletin MS07-020 (932168) *****]
Microsoft Security Bulletin MS07-020
Vulnerability in Microsoft Agent Could Allow Remote Code Execution (932168)
Published: April 10, 2007 | Updated: June 6, 2007
Version: 1.2
Summary
Who Should Read this Document: Customers who use Microsoft Windows
Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Critical
Recommendation: Customers should apply the update immediately
Security Update Replacement: None
Caveats: None
Tested Software and Security Update Download Locations:
Affected Software:
• Microsoft Windows 2000 Service Pack 4 — Download the update
• Microsoft Windows XP Service Pack 2 — Download the update
• Microsoft Windows XP Professional x64 Edition and Microsoft Windows XP
Professional x64 Edition Service Pack 2 — Download the update
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service
Pack 1 and Microsoft Server 2003 Service Pack 2 — Download the update
• Microsoft Windows Server 2003 x64 Edition with Service Pack 1 and Microsoft
Windows Server 2003 x64 Edition with Service Pack 2 — Download the update
• Microsoft Windows Server 2003 for Itanium-based Systems, Microsoft Windows
Server 2003 with SP1 for Itanium-based Systems, and Microsoft Windows Server
2003 with SP2 for Itanium-based Systems — Download the update
Non-Affected Software:
• Windows Vista
• Windows Vista x64 Edition
The software in this list has been tested to determine whether the versions are
affected. Other versions are either past their support life cycle or are not
affected. To determine the support life cycle for your product and version,
visit the Microsoft Support Lifecycle Web site.
Top of section
General Information
Executive Summary
Executive Summary:
This update resolves a newly discovered, privately reported vulnerability. The
vulnerability is documented in its own subsection in the Vulnerability Details
section of this bulletin.
We recommend that customers apply the update immediately.
Severity Ratings and Vulnerability Identifiers:
Vulnerability Identifiers Impact of Vulnerability Microsoft Windows 2000 Service
Pack 4 Microsoft Windows XP Service Pack 2 Microsoft Windows Server 2003
Microsoft Windows Server 2003 Service Pack 1 Microsoft Windows Server 2003
Service Pack 2
Microsoft Agent URL Parsing Vulnerability - CVE-2007-1205
Remote Code Execution
Critical
Critical
Moderate
Moderate
Moderate
This assessment is based on the types of systems that are affected by the
vulnerability, their typical deployment patterns, and the effect that
exploiting the vulnerability would have on them.
Note The severity ratings for non-x86 operating system versions map to the x86
operating systems versions as follows:
• The Windows XP Professional x64 Edition and Windows XP Professional x64
Edition Service Pack 2 severity ratings are the same as the Windows Server
2003 Service Pack 1 severity rating.
• The Windows Server 2003 for Itanium-based Systems severity rating is the same
as the Windows Server 2003 severity rating.
• The Windows Server 2003 with SP2 for Itanium-based Systems severity rating is
the same as the Windows Server 2003 Service Pack 2 severity rating.
• The Windows Server 2003 x64 Edition with Service Pack 1 and Microsoft Windows
Server 2003 x64 Edition with Service Pack 2 severity ratings are the same as
the Windows Server 2003 Service Pack 2 severity rating.
Vulnerability Details
* Microsoft Agent URL Parsing Vulnerability Could Allow Remote Code Execution-
CVE-2007-1205:
A remote code execution vulnerability exists in Microsoft Agent in the way that
it handles certain specially crafted URLs.
* Mitigating Factors for Microsoft Agent URL Parsing Vulnerability - CVE-2007-1205:
* Workarounds for Microsoft Agent URL Parsing Vulnerability - CVE-2007-1205:
* FAQ for Microsoft Agent URL Parsing Vulnerability - CVE-2007-1205:
Security Update Information
Affected Software:
For information about the specific security update for your affected software,
see the appropriate section:
* Windows 2000 (all versions)
* Windows XP (all versions)
* Windows Server 2003 (all versions)
Acknowledgments
Microsoft thanks the following for working with us to help protect customers:
• JJ Reyes and Carsten Eiram of Secunia for reporting the Microsoft Agent URL
Parsing Vulnerability (CVE-2007-1205).
Obtaining Other Security Updates:
Updates for other security issues are available at the following locations:
• Security updates are available at the Microsoft Download Center. You can find
them most easily by doing a keyword search for "security_patch."
• Updates for consumer platforms are available at the Microsoft Update Web site.
Support:
• Customers in the U.S. and Canada can receive technical support from Microsoft
Product Support Services at 1-866-PCSAFETY. There is no charge for support
calls that are associated with security updates.
• International customers can receive support from their local Microsoft
subsidiaries. There is no charge for support that is associated with security
updates. For more information about how to contact Microsoft for support issues,
visit the International Support Web site.
Security Resources:
• The Microsoft TechNet Security Web site provides additional information about
security in Microsoft products.
• TechNet Update Management Center
• Microsoft Software Update Services
• Microsoft Windows Server Update Services
• Microsoft Baseline Security Analyzer (MBSA)
• Windows Update
• Microsoft Update
• Windows Update Catalog: For more information about the Windows Update Catalog,
see Microsoft Knowledge Base Article 323166.
• Office Update
Software Update Services:
By using Microsoft Software Update Services (SUS), administrators can quickly and
reliably deploy the latest critical updates and security updates to Windows 2000
and Windows Server 2003-based servers, and to desktop systems that are running
Windows 2000 Professional or Windows XP Professional.
For more information about how to deploy security updates by using Software Update
Services, visit the Software Update Services Web site.
Windows Server Update Services:
By using Windows Server Update Services (WSUS), administrators can quickly and
reliably deploy the latest critical updates and security updates for Windows 2000
operating systems and later, Office XP and later, Exchange Server 2003, and SQL
Server 2000 onto Windows 2000 and later operating systems.
For more information about how to deploy security updates using Windows Server
Update Services, visit the Windows Server Update Services Web site.
Systems Management Server:
Microsoft Systems Management Server (SMS) delivers a highly configurable enterprise
solution for managing updates. By using SMS, administrators can identify Windows-
based systems that require security updates and can perform controlled deployment
of these updates throughout the enterprise with minimal disruption to end users.
For more information about how administrators can use SMS 2003 to deploy security
updates, visit the SMS 2003 Security Patch Management Web site. SMS 2.0 users can
also use Software Updates Service Feature Pack to help deploy security updates.
For information about SMS, visit the SMS Web site.
Note SMS uses the Microsoft Baseline Security Analyzer, the Microsoft Office
Detection Tool, and the Enterprise Update Scan Tool to provide broad support for
security bulletin update detection and deployment. Some software updates may not
be detected by these tools. Administrators can use the inventory capabilities of
the SMS in these cases to target updates to specific systems. For more information
about this procedure, visit the following Web site. Some security updates require
administrative rights following a restart of the system. Administrators can use
the Elevated Rights Deployment Tool (available in the SMS 2003 Administration
Feature Pack and in the SMS 2.0 Administration Feature Pack) to install these
updates.
Disclaimer:
The information provided in the Microsoft Knowledge Base is provided "as is"
without warranty of any kind. Microsoft disclaims all warranties, either express
or implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Microsoft Corporation or its suppliers be
liable for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if Microsoft
Corporation or its suppliers have been advised of the possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation may not apply.
Revisions:
• V1.0 (April 10, 2007): Bulletin published.
• V1.1 (April 10, 2007): Bulletin Revised: Updated the File Information table for Windows Server 2003 platforms to include all updated files and correct file versions.
• V1.2 (June 6, 2007): Bulletin Revised: Removed the literal “with Service Pack 1” from all instances of “Windows Server 2003 x64 Edition with Service Pack 1”.
[***** End Microsoft Security Bulletin MS07-020 (932168) *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of Microsoft for the
information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
R-190: Network Audio System Vulnerabilties
R-191: Multiple Cisco Unified CallManager and Presence Server Denial of Service Vulnerabilities
R-192: Vulnerabilities in Graphics Rendering Engine (GDI)
R-193: krb5 Security Update
R-194: XFree86 Security Update
R-195: xorg-x11-server Security Update
R-196: libXfont Security Update
R-197: Intel Centrino Wireless Driver Malformed Frame Vulnerability
R-198: Vulnerabilities in Microsoft Content Management Server
R-199: Vulnerability in Universal Plug and Play