=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2008/VULN428
_____________________________________________________________________

DATE                      : 15/10/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Windows running SMB.

======================================================================
KB957095
http://www.microsoft.com/technet/security/bulletin/ms08-063.mspx
______________________________________________________________________

Microsoft Security Bulletin MS08-063 - Important

Vulnerability in SMB Could Allow Remote Code Execution (957095)

   Published: October 14, 2008

   Version: 1.0

General Information

Executive Summary

   This security update resolves a privately reported vulnerability in
   Microsoft Server Message Block (SMB) Protocol. The vulnerability could
   allow remote code execution on a server that is sharing files or
   folders. An attacker who successfully exploited this vulnerability
   could install programs; view, change, or delete data; or create new
   accounts with full user rights.

   This security update is rated Important for all supported editions of
   Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows
   Vista, and Windows Server 2008. For more information, see the
   subsection, Affected and Non-Affected Software, in this section.

   The security update addresses the vulnerability by modifying the way
   that SMB handles file name length validation and file sharing.

   Recommendation. Microsoft recommends that customers apply the update
   at the earliest opportunity.

Affected Software

   Microsoft Windows 2000 Service Pack 4

   Windows XP Service Pack 2

   Windows XP Service Pack 3

   Windows XP Professional x64 Edition

   Windows XP Professional x64 Edition Service Pack 2

   Windows Server 2003 Service Pack 1

   Windows Server 2003 Service Pack 2

   Windows Server 2003 x64 Edition

   Windows Server 2003 x64 Edition Service Pack 2

   Windows Server 2003 with SP1 for Itanium-based Systems

   Windows Server 2003 with SP2 for Itanium-based Systems

   Windows Vista and Windows Vista Service Pack 1

   Windows Vista x64 Edition

   Windows Vista x64 Edition Service Pack 1

   Windows Server 2008 for 32-bit Systems

   Windows Server 2008 for x64-based Systems

   Windows Server 2008 for Itanium-based Systems

Vulnerability Information

SMB Buffer Underflow Vulnerability - CVE-2008-4038

   A remote code execution vulnerability exists in the way that Microsoft
   Server Message Block (SMB) Protocol handles specially crafted file
   names. An attempt to exploit the vulnerability would require
   authentication because the vulnerable function is only reachable when
   the share type is a disk, and by default, all disk shares require
   authentication. An attacker who successfully exploited this
   vulnerability could install programs; view, change, or delete data; or
   create new accounts with full user rights.

Workarounds for SMB Buffer Underflow Vulnerability - CVE-2008-4038

   Microsoft has not identified any workarounds for this vulnerability.


======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================