Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2002.276 -- Microsoft Security Bulletin MS02-022 Unchecked Buffer in MSN Chat Control Can Lead to Code Execution (Q321661) 12 June 2002 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: MSN Messenger 4.5 MSN Messenger 4.6 Exchange Instant Messenger 4.5 Exchange Instant Messenger 4.6 MSN Chat Control Vendor: Microsoft Operating System: Windows Impact: Execute Arbitrary Code/Commands Access Required: Remote Ref: ESB-2002.218 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- - - ---------------------------------------------------------------------- Title: Unchecked Buffer in MSN Chat Control Can Lead to Code Execution (Q321661) Released: 08 May 2002 Revised: 11 June 2002 (version 2.0) Software: MSN Chat, MSN Messenger, Exchange Instant Messenger Impact: Run Code of Attacker's Choice Max Risk: Critical Bulletin: MS02-022 Microsoft encourages customers to review the Security Bulletin at: http://www.microsoft.com/technet/security/bulletin/MS02-022.asp. - - ---------------------------------------------------------------------- Reason for Revision: ==================== On May 8 2002, Microsoft released the original version of this bulletin. On June 11, 2002 the bulletin was updated to announce that while the fixes issued on May 8 2002 resolved the vulnerability, they did not protect in all cases against the reintroduction of the vulnerable control. As a result, a new set of fixes is being released to ensure that systems are fully protected against the reintroduction of the vulnerable control. A new MSN Chat control, updated patch, updated version of MSN Messenger and an updated version of Exchange Instant Messenger have been made available. Customers who have applied any of the fixes released on May 8, 2002 are encouraged to consider applying the updated fixes. Issue: ====== The MSN Chat control is an ActiveX control that allows groups of users to gather in a single, virtual location online to engage in text messaging. The control is offered for download as a single ActiveX control from a number of MSN sites. In addition, it is included with MSN Messenger since version 4.5 and Exchange Instant Messenger. While the MSN Chat control is included with these products it is not used to provide Instant Messaging functionality, but rather to add chat functionality to those products. An unchecked buffer exists in one of the functions that handles input parameters in the MSN Chat control. A security vulnerability results because it is possible for a malicious user to levy a buffer overrun attack and attempt to exploit this flaw. A successful attack could allow code to run in the user's context. It would be possible for an attacker to attempt to exploit this vulnerability either through a malicious web site or through HTML email. However, Outlook Express 6.0 and the Outlook Email Security Update, which is available for Outlook 98 and Outlook 2000, Outlook 2002 and can thwart such attempts through their default security settings. Mitigating Factors: ==================== - A successful attack would require that the user have installed the MSN Chat control, MSN Messenger, or Exchange Instant Messenger. - The MSN Chat control does not install with any version of Windows or Internet Explorer by default. - Windows Messenger which ships with Windows XP does not include the MSN Chat control. Windows XP users would be vulnerable only if they have chosen to install the MSN Chat control from MSN sites. - The HTML email attack vector is blocked by the following Microsoft mail products: - Outlook 98 and Outlook 2000 with the Outlook Email Security Update - Outlook 2002 - Outlook Express. This is because these products all open HTML email in the Restricted Sites zone by default. Risk Rating: ============ - Internet systems: Low - Intranet systems: Low - Client systems: Critical Patch Availability: =================== - A patch is available to fix this vulnerability. Please read the Security Bulletin at http://www.microsoft.com/technet/security/bulletin/ms02-022.asp for information on obtaining this patch. Acknowledgment: =============== - eEye Digital Security (http://www.eeye.com) - - --------------------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. - -----BEGIN PGP SIGNATURE----- Version: PGP 7.1 iQEVAwUBPQZTWY0ZSRQxA/UrAQHpjAgAmXbWZiDgPukry+5gdrlHX8tYaOP9XPge KJrEC+iigp4l8oYEQ3IcFQLfZ9yia7tCHbThvGqPpiLmVAPuoidHUGU2LAZfVBXd r8n/1MuoFjZsQwQrdYc1iz/Qe6CD2W2rzdfI96vHyp6D0mjzdp9M3KCkosuZ0NF7 qaHtba/UGux4AcZM1vM8YOuwe0Ub2lO/HNaZJdB6S65Orhkff0bKoW31LXK/5eom s0gHGpqGpBfBWMAW4Keda+GjbuxlDBhqeyAWzZXt9bP9DlYVRX0Vbn+TIIOPzFYn DxNzzjnt4xmlC19QcYLXXjTapW6+5PmKg3580i1BCOzBJWx90SwoXg== =KPt1 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBPQdBzSh9+71yA2DNAQFNhQP9GLT1tHJ/6Yo6mPatX4ErKISLIXIK8z2O 7Ft456BzNpSvs1Rvqn7buB+HzAKy7lONKMGGrN2ShPWlDsPn3bDjIlby6qCBstZz q+4043GN6yHqTfGOT02GTpotP6rLLiiIz92yNIuSEXZZ6+gBdjiUdraTN+P3bua3 qAsaiupki+s= =+PEL -----END PGP SIGNATURE-----