HOME > VULNERABILITY NOTES


   VULNERABILITY NOTE

 

CERT-In Vulnerability Note CIVN-2008-178
Multiple Vulnerabilities in Microsoft XML Core Services

Original Issue Date:November 12, 2008

Severity Rating: High

Systems Affected

  • Microsoft Windows 2000 Service Pack 4
  • Windows XP Service Pack 2
  • Windows XP Service Pack 3
  • Windows XP Professional x64 Edition
  • Windows XP Professional x64 Edition Service Pack 2
  • Windows Server 2003 Service Pack 1
  • Windows Server 2003 Service Pack 2
  • Windows Server 2003 x64 Edition
  • Windows Server 2003 x64 Edition Service Pack 2
  • Windows Server 2003 with SP1 for Itanium-based Systems
  • Windows Server 2003 with SP2 for Itanium-based Systems
  • Windows Vista
  • Windows Vista Service Pack 1
  • Windows Vista x64 Edition
  • Windows Vista x64 Edition Service Pack 1
  • Windows Server 2008 for 32-bit Systems
  • Windows Server 2008 for x64-based Systems
  • Windows Server 2008 for Itanium-based Systems
  • Microsoft Office 2003 Service Pack 3
  • Microsoft Word Viewer 2003 Service Pack 3
  • 2007 Microsoft Office System
  • 2007 Microsoft Office System Service Pack 1
  • Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats
  • Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1
  • Microsoft Expression Web
  • Microsoft Expression Web 2
  • Microsoft Office SharePoint Server 2007 (32-bit editions)
  • Microsoft Office SharePoint Server 2007 Service Pack 1 (32-bit editions)
  • Microsoft Office SharePoint Server 2007 and Microsoft Office SharePoint Server 2007 Service Pack 1 (64-bit editions)
  • Microsoft Office Groove Server 2007

Overview

Multiple vulnerabilities have been reported in Microsoft XML Core Services that could allow remote attackers to cause denial of service crashes of Internet Explorer and to allow remote code execution while browsing specially crafted web page using Internet Explorer.

Description

 Microsoft XML Core Services (MSXML) is a set of services that allow applications, written in different languages like; JScript, VBScript, and Microsoft development tools, to build Windows-native XML-based applications. It supports XML 1.0, DOM , SAX, an XSLT 1.0 processor, XML schema support including XSD and XDR, as well as other XML-related technologies.

1. MSXML Memory Corruption Vulnerability (CVE-2007-0099)

A remote code execution vulnerability has been reported in Microsoft XML Core Services. This vulnerability is caused while MSXML Core Services parses XML content when a user open specially crafted web pages or specially crafted HTML e-mail using Internet Explorer. Successful exploitation of this vulnerability could allow remote code execution in the context of currently logged in user.

Workaround

  • Restrict access to msxml3.dll

2. MSXML DTD Cross-Domain Scripting Vulnerability
    (CVE-2008-4029)

An information disclosure vulnerability has been reported in Microsoft XML Core Services. This vulnerability is caused due to improper handling of error checks for external document type definitions (DTDs), which allows a violation of cross-domains policy. This vulnerability could be exploited, if a user browses specially crafted web page or specially crafted HTML e-mail using Internet Explorer. Successful exploitation of this vulnerability could allow an attacker to read data from a web page in another domain in Internet Explorer.

Workarounds

  • Disable Active Scripting in the Internet and Local intranet security zone, if not required.
  • Set Internet and Local intranet security zone settings to “High” to prompt before running or configure Internet Explorer to prompt before running Active Scripting
    ActiveX Controls and Active Scripting in these zones
  • Prevent MSXML ActiveX objects from running in Internet Explorer

3. MSXML Header Request Vulnerability (CVE-2008-4033)

An information disclosure vulnerability has been reported in Microsoft XML Core Services. This vulnerability is caused due to improper handling of transfer-encoding headers, which allows a violation of cross-domains policy. This vulnerability could be exploited, if a user browses specially crafted web page or specially crafted HTML e-mail using Internet Explorer. Successful exploitation of this vulnerability could allow an attacker to read data from a web page in another domain in Internet Explorer.

Workarounds

  • Disable Active Scripting in the Internet and Local intranet security zone, if not required.
  • Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones or configure Internet Explorer to prompt before running Active Scripting

    Note: Windows Server 2008 Server Core installation is not affected by these vulnerabilities.

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin MS08-069

Vendor Information

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms08-069.mspx

References

 SecurityTracker
http://www.securitytracker.com/alerts/2008/Nov/1021164.html

 SecurityFocus
http://www.securityfocus.com/bid/21872
http://www.securityfocus.com/bid/32155
http://www.securityfocus.com/bid/32204

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms07-042.mspx

CERT-In
http://www.cert-in.org.in/vulnerability/civn-2007-102.htm

Secunia
http://secunia.com/advisories/23655/

FrSIRT
http://www.frsirt.com/english/advisories/2008/3111

SecurityFocus
http://www.securityfocus.com/bid/32204

CVE Name
CVE-2007-0099
CVE-2008-4029
CVE-2008-4033

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information


Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003