MS04-035: Vulnerability in SMTP

[Steven]

Microsoft Security Bulletin MS04-035

Vulnerability in SMTP Could Allow Remote Code Execution (885881)

Issued: October 12, 2004

Version: 1.0

Summary

Who should read this document: System administrators who use Microsoft Exchange Server 2003, Windows XP 64-Bit Edition Version 2003, or Windows Server 2003

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately.

Security Update Replacement: None

Caveats: None

Tested Software and Security Update Download Locations:

Affected Software:

?Microsoft Windows XP 64-Bit Edition Version 2003 ? Download the update (KB885881)

?Microsoft Windows Server 2003 ? Download the update (KB885881)

?Microsoft Windows Server 2003 64-Bit Edition ? Download the update (KB885881)

?Microsoft Exchange Server 2003 and Microsoft Exchange Server 2003 Service Pack 1 when installed on Microsoft Windows Server 2003 (uses the Windows 2003 SMTP component)

?Microsoft Exchange Server 2003 when installed on Microsoft Windows 2000 Service Pack 3 or Microsoft Windows 2000 Service Pack 4 ? Download the update (KB885882)

Non-Affected Software:

?Microsoft Windows NT Server 4.0 Service Pack 6a

?Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6

?Microsoft Windows 2000 Service Pack 3 or Microsoft Windows 2000 Service Pack 4

?Microsoft Windows XP, Microsoft Windows XP Service Pack 1, and Microsoft Windows XP Service Pack 2

?Microsoft Windows XP 64-Bit Edition Service Pack 1

?Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

?Microsoft Exchange Server 5.0 Service Pack 2

?Microsoft Exchange Server 5.5 Service Pack 4

?Microsoft Exchange 2000 Server Service Pack 3

?Microsoft Exchange Server 2003 Service Pack 1 when installed on Microsoft Windows 2000 Service Pack 3 or Microsoft Windows 2000 Service Pack 4

Tested Microsoft Windows and Exchange components:

?Microsoft Windows NT Server 4.0 Service Pack 6a SMTP component

?Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 SMTP component

?Microsoft Windows 2000 Service Pack 3 STMP component and Microsoft Windows 2000 Service Pack 4 SMTP component

?Microsoft Windows XP SMTP component, Microsoft Windows XP Service Pack 1 SMTP component, and Microsoft Windows XP Service Pack 2 SMTP component

?Microsoft Windows XP 64-Bit Edition Service Pack 1 SMTP component

?Microsoft Windows XP 64-Bit Edition Version 2003 SMTP component

?Microsoft Windows Server 2003 SMTP component

?Microsoft Windows Server 2003 64-Bit Edition SMTP component

?Microsoft Exchange Server 2003 Routing Engine component

Affected components:

?Microsoft Windows XP 64-Bit Edition Version 2003 SMTP component

?Microsoft Windows Server 2003 SMTP component

?Microsoft Windows Server 2003 64-Bit Edition SMTP component

?Microsoft Exchange Server 2003 Routing Engine component

The software in this list has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support lifecycle for your product and version, visit the following Microsoft Support Lifecycle Web site.

Executive Summary:

This update resolves a newly-discovered vulnerability. A remote code execution vulnerability exists in the Simple Mail Transfer Protocol (SMTP) component that is provided as part of the affected software. The vulnerability is documented in the Vulnerability Details section of this bulletin.

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

We recommend that customers apply the update immediately.

http://www.microsoft.com/technet/security/...n/MS04-035.mspx