Microsoft Releases 3 Critical Patches - Hilarity Does Not Ensue; MS Patches Reset Settings in Program Defaults?

Published: 2005-06-14. Last Updated: 2005-06-15 00:31:11 UTC
by John Bambenek (Version: 1)

Microsoft Releases 3 Critical Patches - Hilarity Does Not Ensue

Thanks to the other Handlers for their assistance in compiling this summary. All-in-all not a terrible list. -025 will probably lead to another round of e-mail worms with images in them which should be easy to filter (this should only impact end-user machines as one hopes you don't surf the web or check e-mail from your servers). -026 requires either the exploitation of a assumed good site, or tricking people to go to a malicious website; expect it to be used in the spyware/adware coming to a pop-up near you. For -027, that traffic should be filtered at your gateway anyway but may have some worm potential. I really hope you aren't running telnet (-033). -031 is the only real pain of the bunch where you'll have to search for orun32.exe to see if you have Interactive Training installed. It may or may not be in Add/Remove Programs.

Bulletin	Severity		Impact


MS05-025	Critical		Remote Code Execution (replaces MS05-020) End-user machines only

MS05-026	Critical		Remote Code Execution (replaces MS03-044, MS04-023, MS05-001)

MS05-027	Critical		Remote Code Execution (replaces MS02-070, MS03-024)

MS05-028	Important		Remote Code Execution

MS05-029	Important		Remote Code Execution

MS05-030	Important		Remote Code Execution

MS05-031	Important		Remote Code Execution

MS05-032	Moderate		Spoofing

MS05-033	Moderate		Information Disclosure

MS05-034	Moderate		Elevation of Privilege

Critical Vulnerabilities

<A href="http://www.microsoft.com/technet/security/bulletin/MS05-025.mspx">Microsoft Security Bulletin MS05-025 - Cumulative Security Update for Internet Explorer (883939) - Critical

This update replaces MS05-020
(<A href="http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx">http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx)

This patch addresses two main issues:

- A vulnerability in the parsing of PNG files. This vulnerability can
be exploited by a visit to a site hosting a malicious graphic file and
allows remote code execution due to an unchecked buffer in the PNG
rendering code.

- An issue in the XML <script> tag handling that can allow a remote
attacker access to read arbitrary XML files, and portions of other files
(by using a URL with the ?src? attribute set to the local file system).

These vulnerabilities affect IE 5.1, 5.5 and 6 on virtually every
Microsoft platform. Also (and this is IMPORTANT) Outlook and Outlook
Express use IE?s HTML rendering engine and are vulnerable to these
issues. The both of these vulnerabilities could be exploited by HTML
email containing a malicious content.

Both of these issues have the potential to be used as part of an email
based virus and could be triggered under Outlook/OE simply by viewing
HTML formatted messages.

It also changes a few other things: Updates the MSIE pop-up blocker,
changes the handling of malformed .GIF and .BMP files, and removes
handling of XBM images from all IE platforms. It also sets the kill bit
for older versions of the Microsoft DigWebX ActiveX control and for all
versions of the Microsoft MsnPUpld ActiveX control. (Why, oh why, must
MS bundle these things together??)

Workarounds:

PNG: Un-register IE?s ability to render PNG files: run ?regsvr32 /u
pngfilt.dll? (This can also be done via registry entries? see the MS
bulletin below).

XML: Setting IE?s ?Internet? zone to ?high security? will limit the
files exposed on the target machine.

Links of interest:

http://www.microsoft.com/technet/security/bulletin/ms05-025.mspx

http://support.microsoft.com/kb/883939

 

<A href="http://www.microsoft.com/technet/security/bulletin/MS05-026.mspx">MS05-026 (KB896358) - Vulnerability in HTML Help Could Allow Remote Code Execution

 
Affects: Essentially all active Windows platforms.

Replaces: MS03-044, MS04-023, MS05-001

 
HTML Help fails to validate input data which could result in the ability
of a remote attacker to execute code on an affected system.

 
An attacker would be required to host malicious content on a website or
via a banner ad. It appears currently that this cannot be exploited
through HTML email.

This may be a possible new avenue for spyware/adware or other bulk
exploiters-for-profit.

Side effects: This security update restricts the use of the InfoTech
protocol (ms-its, its, mk:@msitstore) from processing content that is
served from outside the Local Machine zone. This change may prevent
certain kinds of Web-based applications from functioning correctly.

Workarounds: Un-register the ?InfoTech? protocol from HTML Help by
running ?regsvr32 /u %windir%\system32\itss.dll?

 
Links of interest:

http://www.microsoft.com/technet/security/bulletin/ms05-026.mspx

http://support.microsoft.com/kb/896358

<A href="http://www.microsoft.com/technet/security/bulletin/MS05-027.mspx">MS05-027 (KB896422) - Vulnerability in Server Message Block Could Allow Remote Code Execution. This patch addresses the following vulnerability:

- Server Message Block Vulnerability - A remote code
execution vulnerability exists in Server Message Block (SMB) that could
allow an attacker who successfully exploited this vulnerability to take
complete control of the effected system.

All supported versions of Windows 2000, XP, and Server 2003 appear to have
a severity rating of Critical on this vulnerability. However, XP SP2
systems will be less likely for attack as the affected ports are blocked
from responding by the Windows Firewall by default. Changes to the default
settings will cause the vulnerability to be at the same critical level as
Windows XP SP1.

As has been the standard practice, it is recommended that ports 139 and 445
be blocked at the firewall.

For more information about this vulnerability and the associated patch, see <A href="http://support.microsoft.com/kb/896422">Microsoft Knowledge Base Article 896422.

MS05-027 Update: There have been a few people who have written in expressing confusion on whether there needs to be authentication for this exploit to work. A plain reading of the bulletin by Microsoft indicates that this is a pre-authentication bug and that any anonymous user can theoretically exploit it.