Microsoft Patch Day - July 2007

The condition occurs when several requests are received for a DLLwithin a virtual directory. Failed exploit attempts cause the'inetinfo.exe' process to crash, resulting in a denial-of-servicecondition until the service is restarted. The directory must haveExecute permissions set for "Scripts and Executables". The paths"_vti_bin" and "_sharepoint" can be used by an attacker to trigger theissue. Other attack vectors may also be present, but this has not beenconfirmed.

Exploitation of this issue is trivial, and can be performed manually with common software.

MS07-036;KB936542Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution

This month's Excel patch resolves four or more vulnerabilitiesand applies to Excel 2000, 2002, 2003, and 2007, as well as theMicrosoft Office Compatibility Pack. This bulletin replaces MS07-023,released in May of this year. Microsoft rates these issues as'Important' for all but Excel 2000, for which this bulletin is rated'Critical'. Workarounds include blocking the affected file types atnetwork borders and in the registry (probably not a good option in thiscase) and using the Microsoft MOICE tool to open remotely-providedOffice files. See the advisory for more information.

The bulletin also mentions 'other issues' that were fixed in thisrelease, but technical details were not provided. From the MS07-036Executive Summary: "This critical update resolves [...] other security issues identified during the course of the investigation."

MS07-039 ;KB926122Vulnerability in Windows Active Directory Could Allow Remote Code ExecutionThis bulletin address two issues in LDAP implementations; a codeexecution vulnerability in Windows 2000 and 2003, and a simple denialof service present in Windows 2000.

The LDAP service in Windows 2000 and 2003 fails to check the number of convertible attributes included in a LDAP request.

An attacker can exploit this issue by sending a specially craftedLDAP request to the affected computer, and thereby execute arbitrarycode with SYSTEM-level privileges. Failed exploit attempts will resultin a denial-of-service condition. This issue is rated differently forthe various versions: Any anonymous user with access to the affectednetwork can exploit this issue on Windows 2000. To exploit this issueon Windows 2003, the attacker must have valid authenticationcredentials. No publicly available exploit for this issue is known toexist.

MS07-040;KB931212Vulnerabilities in .NET Framework Could Allow Remote Code Execution

MS07-040 addresses 4 vulnerabilities in the .NET frameworkversions 1.0, 1.1, and 2.0 on any platform. Framework 3.0 on anyplatform is unaffected.. Three of these were privately reported toMicrosoft, and one was publicly known in 2006. For versions 1.0 and1.1, this bulletin also replaces MS05-004.

This issue occurs only when a Web application depends on .NET request filtering before sending data back to the Web browser.

An attacker can exploit this issue to perform multipleinput-validation attacks such as cross-site scripting, SQL-injection,and HTML-injection; other attacks are also possible.

This vulnerability is not explicitly called out as resolved in thematrices in the Microsoft advisory, but the FAQ states that mitigationsagainst this issue are included in the patch. The update is said tomake it easier for developers creating .NET applications to securethose applications against these kinds of attacks.

The .NET PE Loader service can be exploited to execute arbitrarycode. This is a client-side vulnerability, and therefore any privilegesgained by the attacker would be at the level of the victim user. Thisissue affects framework 1.0, 1.1, and 2.0 on 2000, 2003, and XP. It israted Critical for 2000 and XP, but only Moderate for 2003 due to theavailability of Enhanced Security Configuration. There are severalpotential workarounds for this issue, including reducing the scriptingthat is allowed in various browser security zones, disabling .NETbrowser support, and so on. See the advisory for full details.

An attacker can exploit this issue to access sensitive informationcontained in Web page generation scripts. This information may aid infurther attacks; other attacks are also possible.

MS07-037;KB936548
Vulnerability in Microsoft Office Publisher 2007 Could Allow Remote Code Execution

And last, but by no means least:

MS07-038;KB935807
Vulnerability in Windows Vista Firewall Could Allow Information Disclosure

Windows Firewall for Windows Vista is prone to a vulnerability thatmay permit a bypass of existing firewall rules. The problem occursbecause the firewall does not properly enforce rules when acceptingtraffic through the Teredo interface. Specifically, traffic routedthrough the Teredo interface is improperly treated as coming from thelocal network.

An attacker may trigger this vulnerability by sending malicious networkdata through the Teredo network transport system in order to obtainsensitive information; other attacks are also possible.

It should be noted that Windows Vista systems configured with a"Public" network profile are not vulnerable to this issue. A systemconfigured with a "Private" network profile will expose the TCP port5357 through the Teredo interface.

This issue was discovered by Symantec as part of an overall study of Vista security. The Symantec advisory can be read here and a blog article discussing the topic can be found here.This attack and the details that make it possible are quiteinteresting; if you are a networking buff at all I reccomend having adeeper look.