====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN268
____________________________________________________________________

DATE                :  11/07/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version XP, 2003, Vista, 7, 2008
              running Microsoft Data Access Components version 2.8, 6.0.

======================================================================
KB2698365
http://technet.microsoft.com/en-us/security/bulletin/MS12-045
______________________________________________________________________

Microsoft Security Bulletin MS12-045 - Critical Vulnerability in
Microsoft Data Access Components Could Allow Remote Code Execution
(2698365)

Published Date: July 10, 2012

Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows. The vulnerability could allow remote code execution
if a user views a specially crafted webpage. An attacker who
successfully exploited this vulnerability could gain the same user
rights as the current user. Users whose accounts are configured to have
fewer user rights on the system could be less impacted than users who
operate with administrative user rights.

This security update is rated Critical for all supported editions of
Windows XP, Windows Vista, and Windows 7; and Moderate for all supported
editions of Windows Server 2003, Windows Server 2008, and Windows Server
2008 R2. For more information, see the subsection, Affected and
Non-Affected Software, in this section.

Affected Software

Microsoft Data Access Components 2.8 Service Pack 1
Microsoft Data Access Components 2.8 Service Pack 2
Windows Data Access Components 6.0
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Vulnerability Information

ADO Cachesize Heap Overflow RCE Vulnerability - CVE-2012-1891

A remote code execution vulnerability exists in the way that Microsoft
Data Access Components accesses an object in memory that has been
improperly initialized. An attacker who successfully exploited this
vulnerability could run arbitrary code on the target system. An attacker
could then install programs; view, change, or delete data; or create new
accounts with full user rights.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================