INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | A remote code execution vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol handles NTLM credentials when a user connects to an attacker's SMB server. This vulnerability allows an attacker to replay the user's credentials back to them and execute code in the context of the logged-on user. |
| PLATFORM: | Windows 2000 (all editions) Windows XP (all editions) Windows Server 2003 (all editions) Windows Vista (all editions) Windows Server 2008 (all editions) |
| DAMAGE: | Remote code execution. |
| SOLUTION: | Upgrade to the appropriate version. |
| VULNERABILITY ASSESSMENT: |
The risk is MEDIUM. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. |
| CVSS 2 BASE SCORE: TEMPORAL SCORE: VECTOR: |
5.4 4.2 (AV:A/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) |
| LINKS: | |
| DOE-CIRC BULLETIN: | http://doecirc.energy.gov/ciac/bulletins/t-024.shtml |
| ORIGINAL BULLETIN: | http://www.microsoft.com/technet/security/Bulletin/MS08-068.mspx |
| CVE: | CVE-2008-4037 |
[***** Start Microsoft Security Bulletin (MS08-068) *****]
Version: 1.1
This security update resolves a publicly disclosed vulnerability in Microsoft Server Message Block (SMB) Protocol. The vulnerability could allow remote code execution on affected systems. An attacker who successfully exploited this vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003, and Moderate for all supported editions of Windows Vista and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.
The security update addresses the vulnerability by modifying the way that SMB authentication replies are validated to prevent the replay of credentials. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.
Recommendation. Microsoft recommends that customers apply the update at the earliest opportunity.
Known Issues. None
The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.
Affected Software
| Operating System | Maximum Security Impact | Aggregate Severity Rating | Bulletins Replaced by this Update |
Remote Code Execution |
Important |
||
Remote Code Execution |
Important |
||
Remote Code Execution |
Important |
None |
|
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 |
Remote Code Execution |
Important |
None |
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 |
Remote Code Execution |
Important |
None |
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 |
Remote Code Execution |
Important |
None |
Remote Code Execution |
Important |
None |
|
Remote Code Execution |
Moderate |
None |
|
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1 |
Remote Code Execution |
Moderate |
None |
Remote Code Execution |
Moderate |
None |
|
Remote Code Execution |
Moderate |
None |
|
Remote Code Execution |
Moderate |
None |
*Windows Server 2008 server core installation affected. For supported editions of Windows Server 2008, this update applies, with the same severity rating, whether or not Windows Server 2008 was installed using the Server Core installation option. For more information on this installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.
 |
Severity Ratings and Vulnerability Identifiers |
|
|
SMB Credential Reflection Vulnerability - CVE-2008-4037 |
| • | Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. |
| • | International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site. |
The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
| • | V1.0 (November 11, 2008): Bulletin published. |
| • | V1.1 (November 12, 2008): Corrected entry in the FAQ for SMB Credential Reflection Vulnerability - CVE-2008-4037 section to clarify reports of published proof of concept code. Microsoft has not received any direct reports that this vulnerability had been publicly used to attack customers. |
[***** End Microsoft Security Bulletin (MS08-068) *****]
Voice: +1 866-941-2472 (7 x 24)
E-mail: doecirc@doecirc.energy.gov
World Wide Web: http://www.doecirc.energy.gov/