Home Programs Emergency management Response CCIRC Analytical releases2 AV06-022: Microsoft Security Bulletin MS06-040, MS06-041, MS06-042, MS06-043, MS06-044, MS06-045, MS06-046, MS06-047, MS06-048, MS06-049, MS06-050, MS06-051

Microsoft Security Bulletin MS06-040, MS06-041, MS06-042, MS06-043, MS06-044, MS06-045, MS06-046, MS06-047, MS06-048, MS06-049, MS06-050, MS06-051

Number: AV06-022
Date: 08 August 2006

Purpose

The purpose of this advisory is to bring attention to the following vulnerabilities (9 Critical, and 3 Important) in some Microsoft products.

MS06-040: Vulnerability in Server Service Could Allow Remote Code Execution (921883)

Assessment

Buffer Overrun in Server Service Vulnerability - CVE-2006-3439
There is a remote code execution vulnerability in Server Service that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx

MS06-041: Vulnerability in DNS Resolution Could Allow Remote Code Execution (920683)

Assessment

Winsock Hostname Vulnerability - CVE-2006-3440
There is a remote code execution vulnerability in Winsock that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system. For an attack to be successful the attacker would have to force the user to open a file or visit a website that is specially crafted to call the affected Winsock API.

DNS Client Buffer Overrun Vulnerability - CVE-2006-3441
There is a remote code execution vulnerability in the DNS Client service that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-041.mspx

MS06-042: Cumulative Security Update for Internet Explorer (918899)

Assessment

Redirect Cross-Domain Information Disclosure Vulnerability - CVE-2006-3280
An information disclosure vulnerability exists in Internet Explorer in the way that a redirect is handled. An attacker could exploit the vulnerability by constructing a specially crafted web page that could allow for information disclosure if a user viewed the web page. An attacker who successfully exploited this vulnerability could read file data from a web page in another Internet Explorer domain. This other web page must use gzip encoding or some other compression type supported by Internet Explorer for any information disclosure to occur. This other web page must also be cached on the client side for a successful exploit.

HTML Layout and Positioning Memory Corruption Vulnerability - CVE-2006-3450
A remote code execution vulnerability exists in the way Internet Explorer interprets HTML with certain layout positioning combinations. An attacker could exploit the vulnerability by constructing a specially crafted web page that could potentially allow remote code execution if a user viewed the web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

CSS Memory Corruption Vulnerability - CVE-2006-3451
A remote code execution vulnerability exists in the way Internet Explorer handles chained Cascading Style Sheets (CSS). An attacker could exploit the vulnerability by constructing a specially crafted web page that could potentially allow remote code execution if a user viewed the web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

HTML Rendering Memory Corruption Vulnerability - CVE-2006-3637
A remote code execution vulnerability exists in the way Internet Explorer interprets HTML with certain layout combinations. An attacker could exploit the vulnerability by constructing a specially crafted web page that could potentially allow remote code execution if a user viewed the Web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

COM Object Instantiation Memory Corruption Vulnerability - CVE-2006-3638
A remote code execution vulnerability exists in the way Internet Explorer instantiates COM objects that are not intended to be instantiated in Internet Explorer. An attacker could exploit the vulnerability by constructing a specially crafted web page that could potentially allow remote code execution if a user viewed the Web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Source Element Cross-Domain Vulnerability - CVE-2006-3639
A remote code execution and information disclosure vulnerability exists in Internet Explorer in the way that a redirect is handled. An attacker could exploit the vulnerability by constructing a specially crafted web page that could allow for information disclosure if a user viewed the web page. An attacker who successfully exploited this vulnerability could read file data from a web page in another Internet Explorer domain.

On Windows 2000 Service Pack 4 and Windows XP Service Pack 1 an attacker could exploit the vulnerability by constructing a specially crafted web page that could potentially allow remote code execution if a user viewed the web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Window Location Information Disclosure Vulnerability - CVE-2006-3640
An information disclosure vulnerability exists in Internet Explorer where script can be persisted across navigations and used to gain access to the location of a Window in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted web page that could allow for information disclosure if a user viewed the web page. An attacker who successfully exploited this vulnerability could gain access to the Window location of a Web page in another domain or Internet Explorer zone.

FTP Server Command Injection Vulnerability - CVE-2004-1166
An elevation of privilege vulnerability exists in the way Internet Explorer handles specially crafted FTP links that contain line feeds. An attacker could exploit the vulnerability by constructing a specially crafted web page that could potentially allow the attacker to issue FTP server commands if a user clicked on an FTP link. An attacker who successfully exploited this vulnerability could issue server commands as the user to servers.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Affected Components:

• Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
• Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 or on Microsoft Windows XP Service Pack 1
• Internet Explorer 6 for Microsoft Windows XP Service Pack 2
• Internet Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition
• Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-042.mspx

MS06-043: Vulnerability in Microsoft Windows Could Allow Remote Code Execution (920214)

Assessment

MHTML Parsing Vulnerability - CVE-2006-2766:
There is a remote code execution vulnerability in Windows that results from incorrect parsing of the MHTML protocol. An attacker could exploit the vulnerability by constructing a specially crafted web page or HTML e-mail that could potentially lead to remote code execution if a user visited a specially crafted web site or clicked a link in a specially crafted e-mail message. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Affected Components:

• Outlook Express 6 on Microsoft Windows XP Service Pack 2
• Outlook Express 6 on Microsoft Windows XP Professional x64 Edition
• Outlook Express 6 on Microsoft Windows Server 2003 Service Pack 1
• Outlook Express 6 on Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition

Suggested action

PPSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-043.mspx

MS06-044: Vulnerability in Microsoft Management Console Could Allow Remote Code Execution (917008)

Assessment

MMC Redirect Cross-Site Scripting Vulnerability - CVE-2006-3643:
There is a remote code execution vulnerability in Windows Management Console that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Windows 2000 Service Pack 4

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-044.mspx

MS06-045: Vulnerability in Windows Explorer Could Allow Remote Code Execution (921398)

Assessment

Folder GUID Code Execution Vulnerability - CVE-2006-3281:
A remote code execution vulnerability exists in Windows Explorer due to the way it handles Drag and Drop events. An attacker could exploit the vulnerability by constructing a malicious web page that could potentially allow an attacker to save a file on the user’s system if a user visited a malicious web site or viewed a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system. User interaction is required to exploit this vulnerability.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Important

Affected Software:

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-045.mspx

MS06-046: Vulnerability in HTML Help Could Allow Remote Code Execution (922616)

Assessment

Buffer Overrun in HTML Help Vulnerability - CVE-2006-3357
A vulnerability exists in the HTML Help ActiveX control that could allow remote code execution on an affected system. An attacker could exploit the vulnerability by constructing a malicious web page that could potentially allow remote code execution if a user visited that page. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-046.mspx

MS06-047: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (921645)

Assessment

Visual Basic for Applications Vulnerability - CVE-2006-3649
A remote code execution vulnerability exists in the way that Visual Basic for Applications (VBA) checks the document properties that a host application passes to it when opening a document. This vulnerability could allow an attacker who successfully exploited the vulnerability to take complete control of the affected system.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Office 2000 Service Pack 3
• Microsoft Project 2000 Service Release 1
• Microsoft Access 2000 Runtime Service Pack 3
• Microsoft Office XP Service Pack 3
• Microsoft Project 2002 Service Pack 1
• Microsoft Visio 2002 Service Pack 2
• Microsoft Works Suites:
  • Microsoft Works Suite 2004
  • Microsoft Works Suite 2005
  • Microsoft Works Suite 2006
• Microsoft Visual Basic for Applications SDK 6.0
• Microsoft Visual Basic for Applications SDK 6.2
• Microsoft Visual Basic for Applications SDK 6.3
• Microsoft Visual Basic for Applications SDK 6.4

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-047.mspx

MS06-048: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (922968)

Assessment

Microsoft PowerPoint Mso.dll Vulnerability - CVE-2006-3590
A remote code execution vulnerability exists in PowerPoint and could be exploited when a file containing a malformed shape container is parsed by PowerPoint. Such a file might be included in an e-mail attachment or hosted on a malicious web site. An attacker could exploit the vulnerability by constructing a specially crafted PowerPoint file that could allow remote code execution. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft PowerPoint Malformed Record Vulnerability - CVE-2006-3449
A remote code execution vulnerability exists in PowerPoint and could be exploited when a file containing a malformed record is parsed by PowerPoint. Such a file might be included in an e-mail attachment or hosted on a malicious web site. An attacker could exploit the vulnerability by constructing a specially crafted PowerPoint file that could allow remote code execution. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Office 2000 Service Pack 3
  • Microsoft PowerPoint 2000
• Microsoft Office XP Service Pack 3
  • Microsoft PowerPoint 2002
• Microsoft Office 2003 Service Pack 1 or Service Pack 2
  • Microsoft Office PowerPoint 2003
• Microsoft Office 2004 for Mac
  • PowerPoint 2004 for Mac
• Microsoft Office v. X for Mac
  • PowerPoint 2004 v. X for Mac

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-048.mspx

MS06-049: Vulnerability in Windows Kernel Could Result in Elevation of Privilege (920958)

Assessment

Windows 2000 Kernel Elevation of Privilege Vulnerability - CVE-2006-3444:
There is a privilege elevation vulnerability in Windows 2000 caused by the improper validation of system inputs. This vulnerability could allow a logged-on user to take complete control of the system.

Impact of Vulnerability: Elevation of Privilege

Maximum Severity Rating: Important

Affected Software:

• Microsoft Windows 2000 Service Pack 4

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-049.mspx

MS06-050: Vulnerabilities in Microsoft Windows Hyperlink Object Library Could Allow Remote Code Execution (920670)

Assessment

Hyperlink COM Object Buffer Overflow Vulnerability - CVE-2006-3086:
A remote code execution vulnerability exists in the Hyperlink Object Library. This is due to an unchecked buffer in the code that is used for handling hyperlinks. An attacker could exploit the vulnerability by constructing a malicious hyperlink which could potentially lead to remote code execution if a user clicks a malicious link within an Office file or e-mail message. An attacker who successfully exploited this vulnerability could take complete control of the affected system. User interaction is required to exploit this vulnerability.

Hyperlink Object Function Vulnerability - CVE-2006-3438:
A remote code execution vulnerability exists in the Hyperlink Object Library. This problem exists when the Hyperlink Object Library uses a file containing a malformed function while handling hyperlinks. An attacker could exploit the vulnerability by constructing a malicious hyperlink which could potentially lead to remote code execution if a user clicks a malicious link within an Office file, or e-mail message. An attacker who successfully exploited this vulnerability could take complete control of the affected system. User interaction is required to exploit this vulnerability.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Important

Affected Software:

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-050.mspx

MS06-051: Vulnerability in Windows Kernel Could Result in Remote Code Execution (917422)

Assessment

User Profile Elevation of Privilege Vulnerability - CVE-2006-3443:
There is a privilege elevation vulnerability in the way that Windows 2000 starts applications. This vulnerability could allow a logged-on user to take complete control of the system.

Unhandled Exception Vulnerability - CVE-2006-3648:
There is a remote code execution vulnerability in the way that exception handling is managed on multiple applications that are resident in memory.

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Affected Software:

• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
• Microsoft Windows Server 2003 x64 Edition

Suggested action

PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS06-051.mspx

Note to readers

Canadian Cyber Incident Response Centre (CCIRC) collects information related to cyber threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at 613-991-7000 or goc-cog@psepc-sppcc.gc.ca by e-mail.

Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at 613-993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at 613-993-9620.

For urgent matters or to report any incidents, please contact the Government Operations Centre at:

Phone: 613-991-7000
Fax: 613-996-0995
Secure Fax: 613-991-7094
Email: goc-cog@psepc-sppcc.gc.ca

For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at:

Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@psepc-sppcc.gc.ca