ID

VAR-200805-0217

CVE

CVE-2008-1437

TITLE

Microsoft Malware Protection Engine Service disruption in (DoS) Vulnerabilities

DESCRIPTION

Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different vulnerability than CVE-2008-1438. Attackers can exploit this issue to cause an affected computer to stop responding or to restart. Successful attacks will deny service to legitimate users. ---------------------------------------------------------------------- Secunia Network Software Inspector 2.0 (NSI) - Public Beta The Public Beta has ended. Thanks to all that participated. PROVIDED AND/OR DISCOVERED BY: The vendor credits SoWhat, Nevis Labs. ORIGINAL ADVISORY: MS08-029 (KB952044): http://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Microsoft Malware Protection Engine TWO DoS Vulnerabilities By Sowhat of Nevis Labs Date: 2008.05.14 http://www.nevisnetworks.com http://secway.org/advisory/AD20080514.txt CVE: CVE-2008-1437 CVE-2008-1438 Vendor Microsoft Affected: Windows Live OneCare Microsoft Antigen for Exchange Microsoft Antigen for SMTP Gateway Microsoft Windows Defender Microsoft Forefront Client Security Microsoft Forefront Security for Exchange Server Microsoft Forefront Security for SharePoint Standalone System Sweeper located in Diagnostics and Recovery Toolset 6.0 Details: There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service. 1. CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine (MsMpEng.exe/mpengine.dll for Windows Live OneCare) will crash. Currently, There's no evidence of code execution found. Please note that this vulnerability can be triggered in various ways: a. by sending emails to target mail server which is protected by MS antivirus b. by sending emails to victim who is using Windows Onecare or Windows Defender. c. by convining the victim to visit some websites. d. by sending files (can be any extension) to victims through P2P/IM. Real Time protection is enabled by default, so in the case b&c, the vulnerability can be exploited without any further user interaction after the victim recieved the email or opened the website. 2. CVE-2008-1438 PE Parsing Disk Space D.o.S While parsing a specially crafted file with a malformed "size of header" is scanned by Microsoft Windows OneCare, there will be Disk Space DOS condition. Microsoft Malware protection engine will allocate disk space as much as the PE file "claimed", It can "eat" several Gb disk space of Windows installation driver. Proof of Concept: No POC will be released. Fix: Microsoft has released an update address this issue. http://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx Vendor Response: 2008.04.18 Vendor notified via email 2008.04.18 Vendor response, developing for patch 2008.05.14 Patch Release 2008.05.14 Advisory released -- Sowhat http://secway.org "Life is like a bug, Do you know how to exploit it ?" . The most severe vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code. II. Impact A remote, unauthenticated attacker could execute arbitrary code, gain elevated privileges, or cause a denial of service. III. Solution Apply updates from Microsoft Microsoft has provided updates for these vulnerabilities in the May 2008 Security Bulletin Summary. The security bulletin describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. Administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS). IV. References * US-CERT Vulnerability Notes for Microsoft May 2008 updates - <http://www.kb.cert.org/vuls/byid?searchview&query=ms08-may> * Microsoft Security Bulletin Summary for May 2008 - <http://www.microsoft.com/technet/security/bulletin/ms08-may.mspx> * Microsoft Update - <https://www.update.microsoft.com/microsoftupdate/> * Windows Server Update Services - <http://www.microsoft.com/windowsserversystem/updateservices/default.mspx> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA08-134A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA08-134A Feedback VU#534907" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2008 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 13, 2008: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBSCnrE/RFkHkM87XOAQJAoAf/XrkJlT9AS30/CZwAMO9qta8TbtLQTZR3 /yAV/h2CmOKhFsbjdh8L4+GcP0n66twWhmMBfBs6BosOoaqqhkeJcE6JoyQ2Kso1 MnhXjPJuGtgEPcfYX9bg42rnZ5WDXGh9EuhoZVyUV4UeUQ8qRM8LL3OIWBHubE7R fcOqIVDz/qtCC1U+RUdrbdeV8XB48mshiLoWjxzOT0FzeOKsBwsyHzaO5mAeEy4E 1hsLC2u4idGlq9Ezl82XODyH6vtHBKq7yKDv+FkVHbCqwB+thqPkUo2es+amASra shcJggg39WWmPWphqnBz94rkdwitsvW3ymOWt1F27GecX1sveofLDQ== =rhf4 -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Sowhat smaillist@gmail.com

SOURCES

LAST UPDATE DATE

2024-08-14T12:39:02.056000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE