Security Intelligence Operations

Microsoft Windows contains a vulnerability that could allow an authenticated, remote attacker to execute arbitrary code on an affected system.

The vulnerability is due to errors when processing file names on Server Message Block (SMB) disk-based file stores.  An attacker could exploit this vulnerability by sending a malicious SMB request to the affected system.  If successful, the attacker could execute arbitrary code with elevated privileges, possibly resulting in a complete system compromise.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates.

The following systems are affected:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior
• Windows Server 2003 with SP2 and prior for Itanium-based Systems
• Windows Vista SP1 and prior
• Windows Vista x64 Edition SP1 and prior
• Windows Server 2008 for 32-bit Systems
• Windows Server 2008 for x64-based Systems
• Windows Server 2008 for Itanium-based Systems

The vulnerability exists in a function that is only used by SMB when accessing disk-based shares.  Systems such as printers that share non-disk resources are not affected. In default configurations, disk access over SMB requires authentication.  An attacker will need to authenticate to an affected system to accomplish an exploit.  Systems with looser access controls may be at greater risk of exploitation.

A successful exploit could allow the attacker to execute arbitrary code with the privileges of the SMB server process, which are typically elevated.  The attacker could execute code resulting in a complete system compromise.  The compromise of a server hosting a number of user or group file shares could result in serious information disclosure because the attacker could access any files on the affected system.

If technical details emerge that allow attackers to develop exploit code for this vulnerability, attackers may adapt malicious, mobile code to exploit the vulnerability to spread automatically.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for October 2008 

The update available from Microsoft corrects this vulnerability by performing proper validation of SMB filenames.

Microsoft has released a security bulletin at the following link: MS08-063