[NT] Vulnerability in Windows Active Directory Allows Code Execution (MS07-039)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Vulnerability in Windows Active Directory Allows Code Execution (MS07-039)
------------------------------------------------------------------------

SUMMARY

This critical security update resolves a privately reported vulnerability
in implementations of Active Directory on Windows 2000 Server and Windows
Server 2003 that could allow remote code execution or a denial of service
condition. Attacks attempting to exploit this vulnerability would most
likely result in a denial of service condition. However remote code
execution could be possible. On Windows Server 2003 an attacker must have
valid logon credentials to exploit this vulnerability. An attacker who
successfully exploited this vulnerability could take complete control of
an affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts.

DETAILS

Vulnerable Systems:
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=812e62c5-6e19-4b3b-8a10-861b871e1b41> Microsoft Windows 2000 Server Service Pack 4
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=28e84603-8159-4429-aaff-a1020531e84f> Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=107902f9-be94-457f-a936-519efbd64779> Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=e5e5b425-fe7d-49d5-973f-f3fd7a1e04eb> Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems

Immune Systems:
* Windows 2000 Professional Service Pack 4
* Windows XP Service Pack 2
* Windows XP Professional x64 Edition and Windows XP Professional x64
Edition Service Pack 2
* Windows Vista
* Windows Vista x64 Edition
* Active Directory Application Mode (ADAM) Service Pack 1

Windows Active Directory Remote Code Execution Vulnerability -
CVE-2007-0040
A remote code execution vulnerability exists in the way that Active
Directory validates a LDAP request. An attacker who successfully exploited
this vulnerability could take complete control of an affected system.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0040>
CVE-2007-0040

Windows Active Directory Denial of Service Vulnerability - CVE-2007-3028
A denial of service vulnerability exists in the way that Microsoft Active
Directory validates a client-sent LDAP request. An attacker could exploit
the vulnerability by sending a specially crafted LDAP request to a server
running Active Directory. An attacker who successfully exploited this
vulnerability could cause the server to temporarily stop responding.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3028>
CVE-2007-3028

ADDITIONAL INFORMATION

The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/Bulletin/ms07-039.mspx>

http://www.microsoft.com/technet/security/Bulletin/ms07-039.mspx

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.