=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN334
_____________________________________________________________________

DATE                      : 13/08/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Windows XP, Windows Server 2003, Windows Vista,
                             Windows Server 2008 running Workstation Service.

======================================================================
KB971657
http://www.microsoft.com/technet/security/bulletin/ms09-041.mspx
______________________________________________________________________

Microsoft Security Bulletin MS09-041 - Important

Vulnerability in Workstation Service Could Allow Elevation of Privilege
(971657)

   Published: August 11, 2009

   Version: 1.0

General Information

Executive Summary

   This security update resolves a privately reported vulnerability in
   the Windows Workstation Service. The vulnerability could allow
   elevation of privilege if an attacker created a specially crafted RPC
   message and sent the message to an affected system. An attacker who
   successfully exploited this vulnerability could execute arbitrary code
   and take complete control of an affected system. An attacker could
   then install programs; view, change, or delete data; or create new
   accounts with full user rights. An attacker must have valid logon
   credentials to a vulnerable system in order to exploit this
   vulnerability. The vulnerability could not be exploited by anonymous
   users.

   This security update is rated Important for all supported editions of
   Windows XP and Windows Server 2003, and Moderate for all supported
   editions of Windows Vista and Windows Server 2008. For more
   information, see the subsection, Affected and Non-Affected Software,
   in this section.

   The security update addresses the vulnerability by correcting the
   manner in which the Workstation service allocates and frees memory.
   For more information about the vulnerability, see the Frequently Asked
   Questions (FAQ) subsection for the specific vulnerability entry under
   the next section, Vulnerability Information.

   Recommendation. The majority of customers have automatic updating
   enabled and will not need to take any action because this security
   update will be downloaded and installed automatically. Customers who
   have not enabled automatic updating need to check for updates and
   install this update manually. For information about specific
   configuration options in automatic updating, see Microsoft Knowledge
   Base Article 294871.

   For administrators and enterprise installations, or end users who want
   to install this security update manually, Microsoft recommends that
   customers apply the update at the earliest opportunity using update
   management software, or by checking for updates using the Microsoft
   Update service.

Affected Software

   Windows XP Service Pack 2 and Windows XP Service Pack 3
   Windows XP Professional x64 Edition Service Pack 2
   Windows Server 2003 Service Pack 2
   Windows Server 2003 x64 Edition Service Pack 2
   Windows Server 2003 with SP2 for Itanium-based Systems
   Windows Vista, Windows Vista Service Pack 1, and Windows Vista
     Service Pack 2
   Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack
     1, and Windows Vista x64 Edition Service Pack 2
   Windows Server 2008 for 32-bit Systems and Windows Server 2008 for
     32-bit Systems Service Pack 2
   Windows Server 2008 for x64-based Systems and Windows Server 2008
     for x64-based Systems Service Pack 2
   Windows Server 2008 for Itanium-based Systems and Windows Server
     2008 for Itanium-based Systems Service Pack 2

Vulnerability Information

Workstation Service Memory Corruption Vulnerability - CVE-2009-1544

   An elevation of privilege vulnerability exists in the Windows
   Workstation Service due to a possible "Double Free" condition
   occurring in the service. An attacker who successfully exploited this
   vulnerability could run arbitrary code with elevated privileges. An
   attacker could then install programs; view, change, or delete data; or
   create new accounts with full user rights.



======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================