Security Intelligence Operations

Microsoft XML Core Services (MSXML) versions 3.0, 4.0, 5.0, and 6.0 contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the user.

This vulnerability exists due to insufficient validation of scripts that use MSXML. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to visit a malicious website. A script as part of this website could trigger the corruption of system memory, allowing the attacker to execute arbitrary code with the privileges of the user.

Proof-of-concept code that demonstrates the denial of service condition is available.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates that correct it.

Microsoft XML Core Services versions 3.0, 4.0, 5.0, and 6.0 running on the following systems are vulnerable:

• Windows 2000 SP4 and prior with XML Core Services 6.0 and prior
• Windows XP SP2 and prior with XML Core Services 6.0 and prior
• Windows XP SP3 with XML Core Services 4.0
• Windows Server 2003 SP2 and prior with XML Core Services 6.0 and prior
• Windows Server 2003 x64 Edition with XML Core Services 6.0 and prior
• Windows Server 2003 Itanium-based systems with XML Core Services 6.0 and prior
• Windows Server 2008 with Microsoft XML Core Services 4.0
• Windows Server 2008 x64 Edition with Microsoft XML Core Services 4.0
• Windows Server 2008 Itanium-based systems with Microsoft XML Core Services 4.0
• Windows Vista with XML Core Services 6.0 and prior
• Windows Vista SP1 with XML Core Services 4.0 
• Windows Vista x64 Edition with XML Core Services 6.0 and prior
• Windows Vista x64 Edition SP1 with XML Core Services 4.0
• Expression Web
• Office 2003 SP2 with XML Core Services 5.0
• Word Viewer 2003 with XML Core Services 5.0
• Office 2007 with XML Core Services 5.0 and prior
• Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats 
• Office SharePoint Server with XML Core Services 5.0
• Office Groove Server 2007 with XML Core Services 5.0

The affected XML components likely reside on every system that runs a current Microsoft-based operating system. However, attackers may not target critical systems because the vulnerability cannot be directly exploited and requires user interaction to be successful.

Based on available information, the affected parameter could be either the offset or count parameter of the substringData() method, with count being the most likely affected parameter. The substringData() method accepts input in the form of two parameters: offset data (the index of where to begin copying string input) and count data (how many characters to copy). As a result, an integer overflow issue is the likely result because these parameters only accept 32-bit signed integers as defined by Microsoft's XML documentation for substringData(). The resulting memory corruption is likely caused by the usage of a wrapped integer to perform a large memory copy operation.

As is typical of this class of vulnerability, the greatest threat of exploitation comes from users who follow links without thinking about the consequences. Attackers are likely to provide links to malicious sites using a variety of means, including providing links in e-mail, instant messaging, and postings to a public forum or newsgroup. Links may also be hosted on peer-to-peer sites. Such tactics may include the use of e-mail header spoofing in an attempt to ensure that e-mail messages appear to originate from trusted sources. Because this vulnerability has a strong user component, organizations that have implemented an ongoing and effective user education process are less likely to be affected.

The update available from Microsoft corrects this vulnerability by adding checks to properly validate memory requests.

Windows Vista-based systems that have applied the updated version of XML Core Services 4.0 may experience compatibility or reliability issues in some configurations. Microsoft has released Knowledge Base article 941833 and an associated hotfix to remedy the problem if it should arise.

Microsoft has re-released a security bulletin at the following link: MS07-042 

Microsoft has released a knowledge base article to detail potential Windows Vista compatibility and reliability issues within the previous patches at the following link: 941833

Avaya has released a security advisory at the following link: ASA-2007-356 

US-CERT has released a vulnerability note at the following link: VU#361968