CERT-In Vulnerability Note
CIVN-2011-0175
Microsoft Windows Mail and Windows Meeting Space Remote Code Execution Vulnerability
Original Issue Date:November 09, 2011
Severity Rating: HIGH
Systems Affected
- Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for 32-bit Systems Service Pack 1
- Windows 7 for x64-based Systems
- Windows 7 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Overview
A vulnerability has been reported in Microsoft Windows Mail and Windows Meeting Space which could allow a remote attacker to execute arbitrary code on the affected system.
Description
This vulnerability is caused due to insecure library loading while processing Windows Mail .eml or .wcinv files.
An unauthenticated, remote attacker could exploit this vulnerability by enticing user to view a malicious file from a remote file share. Opening of the file could cause the affected system to load malicious libraries from the file share and execute the contents of the libraries under the security context of the user.
Workaround
- Disable loading of libraries from WebDAV and remote network shares
- Disable the WebClient service
- Block TCP ports 139 and 445 at the firewall
- Use Limited privileged user
- Protect yourself against social engineering attacks
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS11-085
Note: Microsoft Windows Server 2008 or Microsoft Windows Server 2008 R2 installed using Server core installation option are NOT AFFECTED with this vulnerability.
Vendor Information
Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms11-085
References
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=24492
CVE Name
CVE-2011-2016
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|