Microsoft Security Bulletin MS07-054 - Important

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• To exploit the vulnerability, an attacker would have to persuade a user to accept a webcam or video chat invitation in an MSN Messenger or Windows Live Messenger message. An attacker would have no way to force users to accept the webcam or video chat invitation. Instead, an attacker would have to convince users to accept the webcam or video chat invitation.
• An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
• Users of Windows Live Messenger 8.1, released in January 2007, are already protected from this vulnerability. Users of MSN Messenger 7.0.0820, recently released, are also already protected from this vulnerability.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you perform the upgrade. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Block MSN Messenger or Windows Live Messenger traffic by using ISA Server. See Microsoft Knowledge Base Article 925120.

  Impact of workaround. This prevents MSN Messenger or Windows Live Messenger traffic from entering or leaving your enterprise.

• Block select network ports for MSN Messenger or Windows Live Messenger. See Microsoft Knowledge Base Article 927847.

  Impact of workaround. This allows administrators to selectively prevent webcam and video chat sessions, as opposed to blocking MSN Messenger or Windows Live Messenger traffic completely.

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs or view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

What causes the vulnerability? 
The vulnerability exists in the way MSN Messenger or Windows Live Messenger handles specially crafted webcam or video chat sessions. As a result, memory may be corrupted in such a way that an attacker could execute arbitrary code in the security context of the logged-in user.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs or view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

How could an attacker exploit the vulnerability? 
An attacker could send an invitation to a user to join in a specially crafted webcam or video chat session that is designed to exploit this vulnerability. However, an attacker would have no way to force users to join a webcam or video chat session. Instead, an attacker would have to convince users to accept the webcam or video chat invitation.

What systems are primarily at risk from the vulnerability? 
This vulnerability requires that a user be signed on to the MSN Messenger or Windows Live Messenger service and accept a webcam or video chat invitation for any malicious action to occur. Therefore, any system where MSN Messenger 6.2, MSN Messenger 7.0, MSN Messenger 7.5, or Windows Live Messenger 8.0 is used, such as workstations or servers, is at risk from this vulnerability.

What does the update do? 
MSN Messenger 7.0.0820 and Windows Live Messenger 8.1 have been updated to sufficiently manage webcam or video chat sessions.

I do not use any webcams. Do I still have to upgrade? 
Yes. When you sign on, the MSN Messenger or Windows Live Messenger service will notify you to upgrade to the appropriate MSN Messenger or Windows Live Messenger client for your platform if you have not done so.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2007-2931.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had seen examples of proof of concept code published publicly but had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Reference Table

The following table contains the information to upgrade to MSN Messenger 7.0.0820:

Reference Table

The following table contains the information to upgrade to Windows Live Messenger 8.1: