TITLE:
Windows Secure Channel Digital Signature Parsing
Vulnerability
SECUNIA ADVISORY ID:
SA25620
VERIFY ADVISORY:
http://secunia.c
om/advisories/25620/
CRITICAL:
Highly critical
IMPACT:
DoS, System access
WHERE:
>From remote
OPERATING SYSTEM:
Microsoft Windows 2000 Advanced Server
http://secunia.com/pro
duct/21/
Microsoft Windows 2000 Datacenter Server
http://secunia.com/p
roduct/1177/
Microsoft Windows 2000 Professional
http://secunia.com/prod
uct/1/
Microsoft Windows 2000 Server
http://secunia.com/pro
duct/20/
Microsoft Windows XP Home Edition
http://secunia.com/pro
duct/16/
Microsoft Windows XP Professional
http://secunia.com/pro
duct/22/
Microsoft Windows Server 2003 Datacenter Edition
http://secunia.com/p
roduct/1175/
Microsoft Windows Server 2003 Enterprise Edition
http://secunia.com/p
roduct/1174/
Microsoft Windows Server 2003 Standard Edition
http://secunia.com/p
roduct/1173/
Microsoft Windows Server 2003 Web Edition
http://secunia.com/p
roduct/1176/
Microsoft Windows Storage Server 2003
http://secunia.com/
product/12399/
DESCRIPTION:
A vulnerability has been reported in Microsoft Windows,
which
can be
exploited by malicious people to cause a DoS (Denial of
Service) or
compromise a vulnerable system.
The vulnerability is caused due to an error within the
Secure
Channel
(Schannel) security package when parsing digital signatures
received
from a server during the SSL handshake. This can be
exploited
to
execute arbitrary code (Windows XP), cause the system to
stop
accepting SSL or TLS connections (Windows 2000), or cause
the
system
to restart (Windows 2003) when a user e.g. visits a
malicious
website.
NOTE: Windows 2000 and 2003 are not exploitable for
arbitrary
code
execution.
SOLUTION:
Apply patches.
Windows 2000 SP4:
http://www.microsof
t.com/downloads/details.aspx?FamilyId=5b8e728c-cb9f-4176-93a
0-bf42d6387f93
Windows XP SP2:
http://www.microsof
t.com/downloads/details.aspx?FamilyId=8615e6f3-415b-4c23-ba5
2-7eef70a11d77
Windows XP Professional x64 Edition (optionally with SP2):
http://www.microsof
t.com/downloads/details.aspx?FamilyId=7e994340-c616-4f66-845
b-7eaf095e968a
Windows Server 2003 SP1/SP2:
http://www.microsof
t.com/downloads/details.aspx?FamilyId=39e6c6d2-7e6f-4992-a73
1-36f44fe2d87f
Windows Server 2003 x64 Edition (optionally with SP2):
http://www.microsof
t.com/downloads/details.aspx?FamilyId=da424772-079c-4351-975
9-8886e0f1ba79
Windows Server 2003 for Itanium-based systems (SP1/SP2):
http://www.microsof
t.com/downloads/details.aspx?FamilyId=028592ff-2b69-472e-b18
6-bd2cc76bdfa4
ORIGINAL ADVISORY:
MS07-031 (KB935840):
http://www.microsoft.com/technet/security/Bullet
in/MS07-031.mspx
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworks imagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================
|
