Microsoft Security Bulletin MS10-043 - Critical

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• This vulnerability only impacts Windows systems that have the Windows Aero theme installed. By default, Windows Aero is not enabled in Windows Server 2008 R2. Also, Windows Server 2008 R2 does not include Windows Aero-capable graphics drivers. To enable Windows Aero, you must obtain graphics drivers from a third-party vendor or from the graphics adapter manufacturer.
• In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Disable the Windows Aero Theme

Disabling the Windows Aero theme prevents this issue from being exploited on affected systems.

Using the Interactive Method

To disable Windows Aero by changing the theme, perform the following steps for each user on a system:

1. Click Start, select the Control Panel, and then click on Appearance and Personalization.
2. Under the Personalization category, click on Change the Theme.
3. Scroll to the bottom of the listed themes and select one of the available Basic and High Contrast Themes.

Using Group Policy

Note The Group Policy MMC snap-in can be used to set policy for a machine, for an organizational unit or an entire domain. For more information about Group Policy, visit the following Microsoft Web sites:

Group Policy collection

What is Group Policy Object Editor?

Core Group Policy tools and settings

To disable Windows Aero by switching to the default setting through group policy, perform the following steps:

1. Open the Group Policy Management Console and configure the console to work with the appropriate Group Policy object, such as, local machine, OU, or domain GPO.
2. Navigate to the following node:
   
   User Configuration - Policies - Administrative Templates - Control Panel - Personalization
3. Double-click Force a specific visual style file or force Windows Classic.
4. Change the setting to Enabled and ensure that the Path to Visual Style text box is blank.
5. Click Apply and click OK to return to the Group Policy Management Console.
6. Refresh the Group Policy on all systems or wait for the next scheduled Group Policy refresh interval for the settings to take effect.

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The Windows Canonical Display Driver does not properly parse information copied from user mode to kernel mode.

What is the Canonical Display Driver (cdd.dll)? 
The Canonical Display Driver (cdd.dll) is used by desktop composition to blend GDI and DirectX drawing. CDD emulates the interface of a Windows XP display driver for interactions with the Win32k GDI graphics engine.

What is GDI? 
The Microsoft Windows graphics device interface (GDI) enables applications to use graphics and formatted text on both the video display and the printer. Windows-based applications do not access the graphics hardware directly. Instead, GDI interacts with device drivers on behalf of applications. For more information about GDI, see the MSDN article, Windows GDI.

What is Windows Aero? 
Windows Aero is the desktop experience available to PCs using a compatible graphics adapter and running the Home Premium, Professional, Ultimate, or Enterprise editions of Windows 7. Windows Aero is an installable option on Windows Server 2008 R2.

What might an attacker use the vulnerability to do? 
In most scenarios, an attacker who successfully exploited this vulnerability could cause the affected system to stop responding and automatically restart.

It is also theoretically possible, but unlikely due to memory randomization, that an attacker who successfully exploited this vulnerability could run arbitrary code. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Why is code execution unlikely for this issue? 
An attacker who attempts to exploit this issue for code execution would need to write executable content to a specific space in kernel memory. However, since the starting address will be random, the final pointer destination will be difficult to predict. The implementation of Address Space Layout Randomization (ASLR) by default on affected systems further complicates this prediction. In most scenarios, exploit code could much more likely result in a denial of service than in code execution.

What is Address Space Layout Randomization (ASLR)? 
Systems implementing Address Space Layout Randomization relocate normally-predictable function entry points pseudo-randomly in memory. For more information regarding ASLR, see the TechNet Magazine article, Inside the Windows Vista Kernel: Part 3.

How could an attacker exploit the vulnerability? 
This vulnerability requires that a user view a specially crafted image file with an affected application. Only applications that use the APIs for GDI for rendering images are affected by this issue.

In a Web-based attack scenario, an attacker would have to host a Web site that contains a specially crafted image file that is used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

What systems are primarily at risk from the vulnerability? 
Workstations are primarily at risk from this vulnerability. Servers could also be at risk if the Aero desktop features are enabled.

Are third-party applications affected by this issue? 
Some third-party image viewing applications may be affected by this issue if they use the APIs for GDI to render images. To ensure that your system is fully protected from the vulnerability described in this bulletin, you should contact the developer or vendor responsible for support for the third-party application directly.

What does the update do? 
The update addresses the vulnerability by correcting the manner in which the Canonical Display Driver parses information copied from user mode to kernel mode.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2009-3678.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.