Bulletin/Advisory Details

MS11-035
Vulnerability in WINS Could Allow Remote Code Execution (2524426)
Microsoft Severity Rating: Critical
eEye Severity Rating: Critical

Description
This security update resolves a privately reported vulnerability in the Windows Internet Name Service (WINS). The vulnerability could allow Remote Code Execution if a user received a specially crafted WINS replication packet on an affected system running the WINS service. By default, WINS is not installed on any affected operating system. Only customers who manually installed this component are affected by this issue. The security update addresses the vulnerability by correcting a logic error that occurs when buffers are passed as parameters.

• WINS Service Failed Response Vulnerability - CVE-2011-1248
  A Remote Code Execution vulnerability exists in the Windows Internet Name Service (WINS) due to insufficient validations for the data structures within specially crafted WINS network packets sent to the WINS service. 
  

Analysis
This bulletin addresses a Remote Code Execution vulnerability within the WINS component of Microsoft Windows Servers. The vulnerability exists because user-supplied values are not cleared from the stack and are later used. An attacker could leverage the vulnerability to execute code with SYSTEM privileges on Windows Server 2003 and Local Service privileges on Windows Server 2008 and Windows Server 2008 R2. With these privileges an attacker could potentially install rootkits or other malware to maintain control over the machine, leverage trust relationships to compromise additional systems, and steal sensitive information to be sold or used at a later time.

Recommendations
Deploy patch immediately to prevent exploitation by attackers.  Until the patch can be installed, block ports TCP/42 and UDP/42 on external-facing firewalls.

MS11-036
Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2545814)
Microsoft Severity Rating: Important
eEye Severity Rating: Important 

Description
This security update resolves two privately reported vulnerabilities in Microsoft PowerPoint. The vulnerabilities could allow Remote Code Execution if a user opens a specially crafted PowerPoint file. An attacker who successfully exploited either of these vulnerabilities could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Installing and configuring Office File Validation (OFV) to prevent the opening of suspicious files blocks the attack vectors for exploiting the vulnerabilities described in CVE-2011-1269 and CVE-2011-1270. The update addresses the vulnerabilities by correcting the way that PowerPoint handles memory when parsing specially crafted PowerPoint files.

• Presentation Memory Corruption RCE Vulnerability - CVE-2011-1269
  Presentation Memory Corruption RCE Vulnerability: A Remote Code Execution vulnerability exists in the way that Microsoft PowerPoint handles specially crafted PowerPoint files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

• Presentation Buffer Overrun RCE Vulnerability - CVE-2011-1270
  A Remote Code Execution vulnerability exists in the way that Microsoft PowerPoint handles specially crafted PowerPoint files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Analysis
This bulletin addresses two Remote Code Execution vulnerabilities within Microsoft Office PowerPoint. The vulnerabilities are caused by improper parsing of PowerPoint files which causes memory to become corrupted in such a way that could be leveraged to execute arbitrary code at the logged-in user's privilege level.  If the user is an administrator, an attacker could potentially use those privileges to install rootkits or other malware to maintain control over the machine, leverage trust relationships to compromise additional systems, and steal sensitive information to be sold or used at a later time.

Recommendations
Deploy patches as soon as possible. Until the patches can be installed, Office File Validation should be enabled to prevent the loading of invalid PowerPoint 2003 and 2007 files.  Additionally, use Microsoft Office File Block policy and Microsoft Office Isolated Conversion Environment (MOICE) to deter exploitation via Office 2003 and earlier binary files.