Multiple Vulnerabilities in Microsoft Products
Original release date: April 13, 2004
Last revised: April 14, 2004
Source: US-CERT
Systems Affected
- Microsoft Windows Operating Systems
- Microsoft Windows Remote Procedure Call (RPC) and Distributed Component Object Model (DCOM) subsystems
- Microsoft Windows MHTML Protocol Handler
- Microsoft Jet Database Engine
Overview
Microsoft Corporation has released a series of security bulletins
affecting most users of the Microsoft Windows operating system. Users
of systems running Microsoft Windows are strongly encouraged to visit
the Windows Security Updates for April 2004 and take actions appropriate to their system configurations.
I. Description
Microsoft has released four security bulletins listing a number of
vulnerabilities which affect a variety of Microsoft Windows software
packages. The following section summarizes the issues identified in
their bulletins.
Summary of Microsoft Bulletins for April 2004
This bulletin addresses 14 vulnerabilities affecting the systems
listed below. There are several new vulnerabilities address by this
bulletin, and several updates to previously reported vulnerabilities.
Impact
Remote attackers could execute arbitrary code on vulnerable systems.
Systems affected
- Windows NT Workstation 4.0
- Windows NT Server 4.0
- Windows NT Server 4.0, Terminal Server Edition
- Windows 2000
- Windows XP
- Windows Server 2003
Vulnerability identifiers
The following table outlines these issues and is based on Microsoft's Security Bulletin:
This bulletin addresses several new vulnerabilities affecting the systems listed below. These vulnerabilities are in Microsoft Windows Remote Procedure Call (RPC) and Distributed Component Object Model (DCOM).
Impact
Remote attackers could execute arbitrary code on vulnerable systems.
Systems affected
- Windows NT Workstation 4.0
- Windows NT Server 4.0
- Windows NT Server 4.0, Terminal Server Edition
- Windows 2000
- Windows XP
- Windows Server 2003
Vulnerability identifiers
The following table outlines these issues and is based on Microsoft's Security Bulletin:
This bulletin addresses a vulnerability affecting the systems listed
below. The vulnerability affects the Microsoft Windows MHTML Protocol
handler and any applications that use it, including Microsoft Outlook
and Internet Explorer. This vulnerability has been assigned VU#323070 and CAN-2004-0380.
Note: MS04-013 includes patches remediating the
vulnerability described in TA04-099A.
Impact
Remote attackers could execute arbitrary code on vulnerable systems.
Systems affected
- Windows NT Workstation
4.0
- Windows NT Server 4.0
- Windows NT Server 4.0, Terminal Server
Edition
- Windows 2000
- Windows XP
- Windows Server
2003
- Windows 98
- Windows 98 Second Edition (SE)
- Windows
Millennium Edition (Windows Me)
Note: This issue affects systems with Outlook Express
installed. Outlook Express is installed by default on most (if not
all) current versions of Microsoft Windows.
This bulletin addresses a vulnerability affecting the systems listed
below. There is a buffer overflow vulnerability in Microsoft's Jet
Database Engine (Jet). An attacker could take control of a vulnerable
system, including installing programs; viewing, changing, or deleting
data; or creating new accounts that have full privileges. This
vulnerability has been assigned VU#740716 and CAN-2004-0197.
Impact
Remote attackers could execute arbitrary code on vulnerable systems.
Systems affected
- Windows NT Workstation 4.0
- Windows NT Server 4.0
- Windows NT Server 4.0, Terminal Server Edition
- Windows 2000
- Windows XP
- Windows Server 2003
Update to TA04-099A
Microsoft has released a patch that addresses the cross-domain
vulnerability discussed in TA04-099A:
Vulnerability in Internet Explorer ITS Protocol Handler.
US-CERT is tracking this issue as VU#323070. This
reference number corresponds to CVE candidate CAN-2004-0380.
The patches and further information about the vulnerability are
available in Microsoft
Security Bulletin MS04-013. MS04-013 is titled Cumulative
Security Update for Outlook Express. Since most (if not all)
current Windows systems have Outlook Express installed by default, and the
MHTML protocol handler is part of the Outlook Express software package,
most (if not all) Windows systems should be considered vulnerable.
TA04-099A and VU#323070 focused on
the ITS protocol handlers; however, the latent vulnerability appears
to be in the MHTML handler shipped as part of Outlook Express. These
documents have been updated.
II. Impact
Several of the issues identified by Microsoft have been described as
Critical
in nature. Each bulletin contains at least one vulnerability which may
allow remote attackers to execute arbitrary code on affected
systems. The privileges gained would depend on the security context of
the software and vulnerability exploited.
III. Solution
Apply an appropriate set of updates from Microsoft
Please see the following site for more information about appropriate remediation.
Windows Security Updates for April 2004
Appendix A. Vendor Information
This appendix contains information provided by vendors for this
technical alert. As vendors report new information to US-CERT, we will update
this section and note the changes in our revision history. If a
particular vendor is not listed below, we have not received their
comments.
Microsoft Corporation
Windows Security Updates for April 2004
Microsoft Security Bulletin MS04-011 -
Security Update for Microsoft Windows (835732)
Microsoft Security Bulletin MS04-012 -
Cumulative Update for Microsoft RPC/DCOM (828741)
Microsoft Security Bulletin MS04-013 -
Cumulative Security Update for Outlook Express (837009)
Microsoft Security Bulletin MS04-014 -
Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001)
Appendix B. References
Feedback: US-CERT Technical Alerts
Copyright 2004 Carnegie Mellon University. Terms of use
Revision History
April 13, 2004: Initial release
April 14, 2004: Updated Vulnerability Note links
Mailing Lists & Feeds
Get Adobe Reader
US-CERT is part of the Department of Homeland Security