Advisory Number: AV05-018
Microsoft Security Bulletin MS05-016, MS05-017, MS05-018, MS05-019, MS05-020, MS05-021, MS05-022, MS05-023
12 April 2005

Purpose
The purpose of this advisory is to bring attention to the following vulnerabilities (5 critical and 3 important) in some Microsoft products

Assessment
Many of these vulnerabilities are commonly vulnerable to remote code execution. An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

MS05-016: Vulnerability in Windows Shell that Could Allow Remote Code Execution

A remote code execution vulnerability exists in the Windows Shell due to the way it handles application association. If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of the affected system. However, user interaction is required to exploit this vulnerability.

Affected Software:

• Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
• Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
• Microsoft Windows Server 2003
• Microsoft Windows Server 2003 for Itanium-based Systems
• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

Impact of Vulnerability: Remote Code Execution

Microsoft's Maximum Severity Rating: Important

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS05-016.mspx

MS05-017: Vulnerability in Message Queuing Could Allow Code Execution

A remote code execution vulnerability exists in Message Queuing that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.

Affected Software:

• Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1
• Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
• Microsoft Windows 98 and Microsoft Windows 98 Second Edition (SE)

Impact of Vulnerability: Remote Code Execution

Microsoft's Maximum Severity Rating: Important

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS05-017.mspx

MS05-018: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege and Denial of Service

A privilege elevation vulnerability exists in the way that Windows process certain fonts. This vulnerability could allow a logged-on-user to take complete control of the system.

A privilege elevation vulnerability exists in the way that the affected operating system versions process certain access requests. This vulnerability could allow a logged on user to take complete control of the system.

A denial of service vulnerability exists that could allow an attacker to send a specially crafted request locally to an affected operating system version. An attacker who exploited this vulnerability could cause the affected system to stop responding and automatically restart.

A privilege elevation vulnerability exists in the way that the affected operating system versions process certain access requests. This vulnerability could allow a logged-on-user to take complete control of the system.

Affected Software:

• Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
• Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
• Microsoft Windows Server 2003
• Microsoft Windows Server 2003 for Itanium-based Systems
• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

Impact of Vulnerability: Elevation of Privilege

Microsoft's Maximum Severity Rating: Important

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS05-018.mspx

MS05-019: Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service

A remote code execution vulnerability exists that could allow an attacker to send a specially crafted IP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to remotely execute code. However, attempts to exploit this vulnerability would most likely result in a denial of service.

A denial of service vulnerability exists that could allow an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to reset existing TCP connections.

A denial of service vulnerability exists that could allow an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system that could cause network performance to degrade and potentially stop the affected system from responding to requests.

A denial of service vulnerability exists that could allow an attacker to send a specially crafted TCP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to reset existing TCP connections.

A denial of service vulnerability exists that could allow an attacker to send a specially crafted TCP/IP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding.

Affected Software:

• Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
• Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
• Microsoft Windows Server 2003
• Microsoft Windows Server 2003 for Itanium-based Systems
• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

Impact of Vulnerability: Remote Code Execution

Microsoft's Maximum Severity Rating: Critical

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/bulletin/MS05-019.mspx

MS05-020: Cumulative Security Update for Internet Explorer

A remote code execution vulnerability exists in Internet Explorer due to the way it handles certain DHTML objects. An attacker could exploit the vulnerability by constructing a malicious web page. This malicious Web page could allow remote code execution if a user visited it. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

A remote code execution vulnerability exists in Internet Explorer due to the way it handles certain URLs. An attacker could exploit the vulnerability by constructing a malicious web page. This malicious Web page could potentially allow remote code execution if a user visited it. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

A remote code execution vulnerability exists in Internet Explorer due to the way it handles Content Advisor files. An attacker could exploit the vulnerability by constructing a specially crafted Content Advisor file. This malicious Content Advisor file could potentially allow remote code execution if a user visited a malicious web site or viewed a malicious e-mail message and accepted the installation of the file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, significant user interaction is required to exploit this vulnerability.

Affected Software:

• Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
• Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
• Microsoft Windows Server 2003
• Microsoft Windows Server 2003 for Itanium-based Systems
• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

Affected Components:

• Internet Explorer 5.01 Service Pack 3 on Microsoft Windows 2000 Service Pack 3
• Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
• Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium Edition
• Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows XP

Service Pack 1

• Internet Explorer 6 Service Pack 1 on Microsoft Windows 98, on Microsoft Windows 98 SE, or on Microsoft Windows Millennium Edition
• Internet Explorer 6 Service Pack 1 for Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
• Internet Explorer 6 for Microsoft Windows Server 2003
• Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
• Internet Explorer 6 for Microsoft Windows XP Service Pack 2

Impact of Vulnerability: Remote Code Execution

Microsoft's Maximum Severity Rating: Critical

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx

MS05-021: Vulnerability in Exchange Server Could Allow Remote Code Execution

A remote code execution vulnerability exists in Microsoft Exchange Server that that could allow an attacker to connect to the SMTP port on an Exchange server and issue a specially-crafted command that could result in a denial of service or allow an attacker to run malicious programs of their choice in the security context of the SMTP service.

Affected Software:

• Microsoft Exchange 2000 Server Service Pack 3
• Microsoft Exchange Server 2003
• Microsoft Exchange Server 2003 Service Pack 1

Impact of Vulnerability: Remote Code Execution

Microsoft's Maximum Severity Rating: Critical

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS05-021.mspx

MS05-022: Vulnerability in MSN Messenger Could Lead to Remote Code Execution

A remote code execution vulnerability exists in MSN Messenger that could allow an attacker who successfully exploited this vulnerable to take complete control of the affected system.

Affected Software:

• MSN Messenger 6.2

Impact of Vulnerability: Remote Code Execution

Microsoft's Maximum Severity Rating: Critical

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS05-022.mspx

MS05-023: Vulnerabilities in Microsoft Word May Lead to Remote Code
Execution

A vulnerability exists in Microsoft Word that could allow an attacker to run arbitrary code on a users system. If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.

A vulnerability exists in Microsoft Word that could allow an attacker to run arbitrary code on a users system. If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.

Affected Software:

• Microsoft Word 2000 and Microsoft Works Suite 2001
• Microsoft Word 2002, Microsoft Works Suite 2002, Microsoft Works Suite 2003, and Microsoft Works Suite 2004
• Microsoft Office Word 2003

Impact of Vulnerability: Remote Code Execution

Microsoft's Maximum Severity Rating: Critical

Suggested Action
PSEPC recommends that administrators test and install the update at the earliest opportunity.
http://www.microsoft.com/technet/security/Bulletin/MS05-023.mspx