CERT-In Vulnerability Note
CIVN-2007-0102
Remote Code Execution Vulnerability in Microsoft XML Core Services
Original Issue Date:August 16, 2007
Severity Rating: HIGH
Systems Affected
Microsoft Core XML Services MSXML 6.x
Microsoft Office 2003 Professional Edition
Microsoft Office 2003 Small Business Edition
Microsoft Office 2003 Standard Edition
Microsoft Office 2003 Student and Teacher Edition
Microsoft Office 2007
Microsoft Office Groove Server 2007
Microsoft Office SharePoint Server 2007
Microsoft XML Core Services MSXML 4.x
Microsoft XML Core Services 3.x
Overview
Remote code execution vulnerability has been reported in Microsoft XML Core Services that could be exploited by an attacker to take complete control of the vulnerable system.
Description
XML Core Services is an application for processing Extensible Stylesheet Language Transformation XSLT in an XML file. Based on Microsofts Component Object Model, XML Core Services is essentially an application programming interface to an XML parser and the XPath processor. The parser organizes the XML data into a tree structure for processing, and the processor converts the XML to Hypertext Markup Language for display
The vulnerability in Microsoft Core XML Services is caused due to insufficient input validation while processing certain script requests causes memory corruption. The attacker could exploit this vulnerability by creating a specially crafted web page .Opening this crafted webpage could corrupt memory and execute arbitrary code on the target system. The code will run with the privileges of the target user.
Workaround
Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS07-042
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms07-042.mspx
References
Secunia
http://secunia.com/advisories/26447/
CVE Name
CVE-2007-2223
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|