• Article

Security Bulletin

Microsoft Security Bulletin MS05-009 - Critical

Vulnerability in PNG Processing Could Allow Remote Code Execution (890261)

Published: February 08, 2005 | Updated: July 06, 2005

Version: 2.4

Issued: February 8, 2005
Updated: July 6, 2005
Version: 2.4

Summary

Who should read this document: Customers who use Microsoft Windows Media Player, Windows Messenger and MSN Messenger

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately

Security Update Replacement: This bulletin replaces a prior security update. See the frequently asked questions (FAQ) section of this bulletin for the complete list.

Caveats: Starting February 10, 2005, the MSN Messenger service will notify customers running a vulnerable version of MSN Messenger that there is an upgrade available. Customers that have accepted this upgrade and have applied the update will be protected from this vulnerability. Customers that have not accepted this upgrade may not be allowed to connect to the MSN Messenger service with a vulnerable version of the client. Clients may be upgraded immediately by installing the update available at the download location provided in the “Affected Software” section below.

Tested Software and Security Update Download Locations:

Affected Software:

  • Microsoft Windows Media Player 9 Series (when running on Windows 2000, Windows XP Service Pack 1 and Windows Server 2003) - Download the update
  • Microsoft Windows Messenger version 5.0 (standalone version that can be installed on all supported operating systems) - Download the update
  • Microsoft MSN Messenger 6.1 - Download the update
  • Microsoft MSN Messenger 6.2 - Download the update
  • Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) - Review the FAQ section of this bulletin for details about these operating systems.

Non-Affected Software:

  • Windows Media Player 6.4
  • Windows Media Player 7.1
  • Windows Media Player for Windows XP (8.0)
  • Windows Media Player 9 Series for Windows XP Service Pack 2
  • Windows Media Player 10
  • Windows Messenger 5.1
  • MSN Messenger for Mac

Tested Microsoft Windows Components:

Affected Components:

  • Microsoft Windows Messenger version 4.7.0.2009 (when running on Windows XP Service Pack 1) - Download the update
  • Microsoft Windows Messenger version 4.7.0.3000 (when running on Windows XP Service Pack 2) - Download the update

The software in this list has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support lifecycle for your product and version, visit the following Microsoft Support Lifecycle Web site.

General Information

Executive Summary

Executive Summary:

This update resolves a newly-discovered, public vulnerability. A remote code execution vulnerability exists in the processing of PNG image formats. The vulnerability is documented in the “Vulnerability Details” section of this bulletin.

An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Severity Ratings and Vulnerability Identifiers:

Vulnerability Identifiers Impact of Vulnerability Windows Media Player 9 Series CAN-2004-1244 Windows Messenger (All affected versions) CAN-2004-0597 MSN Messenger 6.1 and 6.2 CAN-2004-0597
PNG Processing Vulnerability- CAN-2004-1244 Remote Code Execution Critical\ None None
PNG Processing Vulnerability- CAN-2004-0597 Remote Code Execution\ None Moderate Critical\
Aggregate Severity of All Vulnerabilities Critical Moderate\ Critical\

This assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

What updates does this release replace?
This security update replaces a prior security bulletin for Windows Media Player only. The security bulletin ID and version that is affected is listed in the following table.

Bulletin ID Windows Media Player 9 Series MSN Messenger 6.1
MS03-021 Replaced
MS04-010 Replaced

Why have you issued a version 2 of this bulletin?
Subsequent to the release of this bulletin, it was determined that the update for Windows Messenger version 4.7.0.2009 (when running on Windows XP Service Pack 1) was failing to install when distributed via SMS or AutoUpdate. The updated package corrects this behavior.

Customers who have successfully installed the previous update and are now running the 4.7.0.2010 version of Windows Messenger are protected from the vulnerability and do not need to take any action at this time.

How does the extended support for Windows 98, Windows 98 Second Edition, and Windows Millennium Edition affect the release of security updates for these operating systems?
Microsoft will only release security updates for critical security issues. Non-critical security issues are not offered during this support period. For more information about the Microsoft Support Lifecycle policies for these operating systems, visit the following Web site.

For more information about severity ratings, visit the following Web site.

Note A Critical security update for these platforms is available and is provided as part of this security bulletin and can be downloaded from the Windows Update Web site.

Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by any of the vulnerabilities that are addressed in this security bulletin?
Yes. Windows 98, Windows 98 Second Edition, and Windows Millennium Edition are critically affected by this vulnerability. A Critical security update for these platforms is available and is provided as part of this security bulletin and can be downloaded from the Windows Update Web site. For more information about severity ratings, visit the following Web site.

How can I get an update for MSN Messenger?
An update for MSN Messenger is available via the download link under the Affected Software section of this bulletin. Additionally, an updated version of MSN Messenger will be offered directly to customers when they log into MSN Messenger beginning shortly after this update is released.

Why is the update to Windows Messenger 5.0 an upgrade to version 5.1 instead of an update to 5.0?
Due to the architecture of Windows Messenger 5.0, it is not possible to provide an incremental patch. Any fix to Windows Messenger 5.0 requires the deployment of a completely updated Windows Messenger package, in this case the Windows Messenger 5.1 package.

What functionality changes will this new version of Windows Messenger contain?
As well as including the security fix pertaining to this bulletin; Windows Messenger 5.1 contains some additional bug fixes over Windows Messenger 5.0. Full details are on the Windows Messenger 5.1 download page.

Can I use the Microsoft Baseline Security Analyzer (MBSA) to determine if this update is required?
MBSA will determine if this update is required for Windows Media Player. MBSA will not determine if this update is required for Windows Messenger or MSN Messenger. It will provide a note message to this effect. See Microsoft Knowledge Base Article 306460 for information regarding note messages in MBSA.

Microsoft has made available an Enterprise Update Scanning Tool (EST) to assist customers with the detection of needed security updates not currently supported by MBSA.

For detailed information about the programs that MBSA currently does not detect, see Microsoft Knowledge Base Article 306460

What is the Enterprise Update Scanning Tool (EST)?
As part of an ongoing commitment to provide detection tools for bulletin-class security updates, Microsoft delivers a stand-alone detection tool whenever the Microsoft Baseline Security Analyzer (MBSA) and the Office Detection Tool (ODT) cannot detect whether the update is required for an MSRC release cycle. This stand-alone tool is called the Enterprise Update Scanning Tool (EST) and is designed for enterprise administrators. When a version of the Enterprise Update Scanning Tool is created for a specific bulletin, customers can run the tool from a command line interface (CLI) and view the results of the XML output file. To help customers better utilize the tool, detailed documentation will be provided with the tool. There is also a version of the tool that SMS customers can obtain that offers an integrated experience for SMS administrators.

Can I use a version of the Enterprise Update Scanning Tool (EST) to determine whether this update is required?
Yes. Microsoft has created a version of the EST that will determine if you need to apply this update for all of the products listed under Affected Products above. Microsoft Knowledge Base Article 984193 describes the EST in detail, as well as provides a download link to the tool. There is also a version of this tool that SMS customers can obtain. See the following Microsoft Knowledge Base Article 894154.

Can I use Systems Management Server (SMS) to determine if this update is required?
Yes. SMS can help detect and deploy this security update. SMS uses MBSA for detection; therefore, SMS has the same limitation listed earlier in this bulletin related to programs that MBSA does not detect. Additionally, there is a version of the EST that SMS customers can obtain that offers an integrated experience for SMS administrators. For information about SMS, visit the SMS Web site.

The Security Update Inventory Tool is required for detecting Microsoft Windows and other affected Microsoft products. For more information about the limitations of the Security Update Inventory Tool, see Microsoft Knowledge Base Article 306460

Vulnerability Details

PNG Processing Vulnerability in Windows Media Player - CAN-2004-1244:

A remote code execution vulnerability exists in Windows Media Player because it does not properly handle PNG files with excessive width or height values. An attacker could try to exploit the vulnerability by constructing a malicious PNG that could potentially allow remote code execution if a user visited a malicious Web site or clicked a link in a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Mitigating Factors for PNG Processing Vulnerability in Windows Media Player- CAN-2004-1244:

  • In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to exploit this vulnerability through media containing a reference to a malicious PNG file. An attacker would have no way to force users to visit a Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's site or to a site that has been compromised by the attacker.
  • An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Workarounds for PNG Processing Vulnerability in Windows Media Player - CAN-2004-1244:

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

There are several different attack vectors that Microsoft has identified for this vulnerability. Each attack vector has a different workaround.

  • Static WMP File Extension Attack workaround

    Disassociate the WMP file extensions. Disassociate the file extensions (.ASX, .WAX, .WVX, .WPL, .WMX, .WMS, .WMZ) in Windows to avoid previewing or opening files that point to malformed PNG files.

    Manual Steps - Windows Media Player method:

    • Launch Windows Explorer
    • On the Tools Menu select ‘Folder Options’
    • Select the ‘File Types’ tab
    • Scroll to find the .ASX file extension and then press the ‘Delete’ button
    • Repeat step 4 for each of the file extensions listed above.

    In addition, enterprise customers can configure Outlook to block the dangerous files listed using the steps documented in Microsoft Knowledgebase Article 837388. Use these instructions to add the documented file extensions to the Level1 block list.

    Home users can configure Outlook Express to block the dangerous files listed using the steps documented in Microsoft Knowledge Base Article 291387. Use this information to configure each of the file extensions as ‘confirm open after download’ in the Windows file types dialog.

    Impact of Workaround: Deleting the file associations with Media Player has a high potential for breaking corporate users who may be using Windows Media Server / Player to deliver web casts, training etc. Home users trying to watch streaming content on various Web sites may also be impacted by implementing this workaround.

  • Internet Explorer workaround for WMP ActiveX attack

    Disable the Windows Media Player ActiveX Control. To prevent against an attack within a webpage follow these steps to disable the Windows Media Player ActiveX Control:

    Follow the instructions documented in Microsoft Knowledge Base Article 240797 to killbit the following CLSIDs in Internet Explorer:

    CLSID:{6BF52A52-394A-11D3-B153-00C04F79FAA6}PROGID:WMPlayer.OCX.7
CLSID:{22D6F312-B0F6-11D0-94AB-0080C74C7E95}PROGID:MediaPlayer.MediaPlayer.1
CLSID:{05589FA1-C356-11CE-BF01-00AA0055595A}PROGID:AMOVIE.ActiveMovieControl.2

    Impact of Workaround:

    When you disable the Windows Media Player ActiveX control, pages using this control will no longer function as designed. This prevents any content from being played though the control, including audio and video.

  • Content-Type HTTP Header Attack

    The only way to prevent this attack is to remove all of the possible MIME type entries from the registry that associate Windows Media Player with the MIME type listed in the Content-Type header being returned by the server since they all can be abused to exploit the vulnerability. Below is a list of MIME types that are associated with the WMP CLSID.

    HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/vnd.ms-wpl
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-mplayer2
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-ms-wmd
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-ms-wmz
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/aiff
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/basic
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mid
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/midi
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mp3
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mpeg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mpegurl
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mpg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/wav
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-aiff
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-mid
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-midi
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-mp3
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-mpeg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-mpegurl
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-mpg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-ms-wax
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-ms-wma
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-wav
HKEY_CLASSES_ROOT\MIME\Database\Content Type\midi/mid
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/avi
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/mpeg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/mpg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/msvideo
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ivf
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg2a
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf-plugin
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-msvideo
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wm
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wmp
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wmv
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wmx
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-wvx

    Impact of Workaround:

    • These MIME type registry keys all have a CLSID value which points to the following CLSID:
      HKEY_CLASSES_ROOT\CLSID\{CD3AFA8F-B84F-48F0-9393-7EDC34128127}\InprocServer32 This CLSID is associated with WMP.DLL which is responsible for launching Windows Media Player when these MIME types are used. Un-registering WMP.DLL will break Windows Media Player.
    • The MIME types listed in this workaround are specific to Windows XP. There may be additional MIME types available on other platforms.

    Additional information about Windows Media Player File Name Extensions if available at the following MSDN Web site.

FAQ for PNG Processing Vulnerability in Windows Media Player - CAN-2004-1244:

What is the scope of the vulnerability?
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

What causes the vulnerability?
Windows Media Player does not completely validate PNG image formats with a excessive width or height values.

What is PNG?
PNG stands for Portable Network Graphics. The Portable Network Graphics (PNG) format was designed to replace the older and simpler GIF format and, to some extent, the much more complex TIFF format. Additional information about PNG can be found at the following Web site.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

Who could exploit the vulnerability?
Any anonymous user who could host a malformed PNG file on a Web site, network share, or persuade a user to open a PNG file that is sent as an attachment in email could seek to exploit this vulnerability.

How could an attacker exploit the vulnerability?
An attacker could exploit the vulnerability by hosting a specially crafted PNG file on a Web site or network share, and entice a user to visit that Web site. Additionally, and attacker could send a link to a malicious PNG file in an email message and entice a user to click on the link.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative credentials are given the ability to log on to servers and run programs. However, best practices strongly discourage allowing this.

Are Windows 98, Windows 98 Second Edition or Windows Millennium Edition critically affected by this vulnerability?
Windows 98 is not critically affected by this vulnerability, however Windows 98 Second Edition, and Windows Millennium Edition are. A Critical security update for these platforms is available and is provided as part of this security bulletin and can be downloaded from the Windows Update Web site. For more information about severity ratings, visit the following Web site.

What does the update do?
The update addresses the vulnerability by modifying the way that Windows Media Player validates the width and height of a PNG file

When this security bulletin was issued, had this vulnerability been publicly disclosed?
A vulnerability similar to this has been publicly released and assigned Common Vulnerability and Exposure number CAN-2004-0597.

Is this vulnerability the same as the vulnerability described in CAN-2004-0597?
While similar to the vulnerability described here, Windows Media Player does not use or incorporate the affected libpng library. However, Windows Media Player is configured in such a way that makes it susceptible to the vulnerability described here.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

PNG Processing Vulnerability in Windows Messenger - CAN-2004-0597:

A remote code execution vulnerability exists in Windows Messenger because it does not properly handle corrupt or malformed PNG files. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Mitigating Factors for PNG Processing Vulnerability in Windows Messenger - CAN-2004-0597:

  • The nature of the vulnerability is different in Windows Messenger than in MSN Messenger or Windows Media Player. The vulnerability in Windows Messenger would be very complex to exploit and requires a large amount of effort and knowledge about the internal network of an organization to attempt to exploit this vulnerability.
  • A user would have to be running Windows Messenger and have it configured to receive .NET Alerts.

Workarounds for PNG Processing Vulnerability in Windows Messenger - CAN-2004-0597 :

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

Turn off the .NET Alerts feature in Windows Messenger.

  • Open Windows Messenger
  • Go to the Tools menu and select “Options”
  • In the Options Dialog go to the “Privacy” tab.
  • Check the option that says “Don’t download any tabs to my computer”

Note this setting will take effect the next time you sign into Windows Messenger. .Net Alerts are only available on Passport accounts that have signed up to receive them. Users who have never configured their account to receive these alerts will not have this setting available.

FAQ for PNG Processing Vulnerability in Windows Messenger - CAN-2004-0597:

Why have you issued a version 2 of this bulletin?
Subsequent to the release of this bulletin, it was determined that the update for Windows Messenger version 4.7.0.2009 (when running on Windows XP Service Pack 1) was failing to install when distributed via SMS or AutoUpdate. The updated package corrects this behavior.

Customers who have successfully installed the previous update and are now running the 4.7.0.2010 version of Windows Messenger are protected from the vulnerability and do not need to take any action at this time.

What is the scope of the vulnerability?
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

What causes the vulnerability?
Windows Messenger implements the public lipng 1.2.5 version library that is recently found to have several known vulnerabilities.

What is PNG?
PNG stands for Portable Network Graphics. The Portable Network Graphics (PNG) format was designed to replace the older and simpler GIF format and, to some extent, the much more complex TIFF format. Additional information about PNG can be found at the following Web site.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

Who could exploit the vulnerability?
The vulnerability in Windows Messenger would be very complex to exploit and requires a large amount of effort and knowledge about the internal network of an organization to attempt to exploit this vulnerability. An attacker would either need the ability to spoof the .NET Messenger service, or would have to intercept and rewrite communications between the client and the server. Simply sending a malformed PNG image file to Windows Messenger does not exploit this vulnerability.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative credentials are given the ability to log on to servers and run programs. However, best practices strongly discourage allowing this.

Are Windows 98, Windows 98 Second Edition or Windows Millennium Edition critically affected by this vulnerability?
No. None of these vulnerabilities are critical in severity on Windows 98, on Windows 98 Second Edition, or on Windows Millennium Edition. For more information about severity ratings, visit the following Web site.

Could the vulnerability be exploited over the Internet?
No. An attacker would either need the ability to spoof the .NET Messenger service, or would have to intercept and rewrite communications between the client and the server. Simply sending a malformed PNG to Windows Messenger does not exploit this vulnerability. Microsoft has provided information about how you can help protect your PC. End users can visit the Protect Your PC Web site. IT Professionals can visit the Security Center Web site.

What does the update do?
The update addresses the vulnerability by updating the library used by Windows Messenger to one that completely validates the PNG image file that is being processed. Additionally, Windows Messenger will now validate that PNG image files are properly formatted.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
These vulnerabilities have been publicly released and assigned Common Vulnerability and Exposure number CAN-2004-0597, CAN-2004-0598 and CAN-2004-0599.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

PNG Processing Vulnerability in MSN Messenger - CAN-2004-0597:

A remote code execution vulnerability exists in MSN Messenger because it does not properly handle corrupt or malformed PNG image files. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Mitigating Factors for PNG Processing Vulnerability in MSN Messenger - CAN-2004-0597:

  • Starting February 10, 2005, the MSN Messenger service will notify customers running a vulnerable version of MSN Messenger that there is an upgrade available. Customers that have accepted this upgrade and have applied the update will be protected from this vulnerability. Customers that have not accepted this upgrade may not be allowed to connect to the MSN Messenger service.
  • MSN Messenger, by default, does not allow anonymous people to send you messages. An attacker would first need to entice you to add them to your contacts list.

Workarounds for PNG Processing Vulnerability in MSN Messenger - CAN-2004-0597:

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

  • Review all of the contacts currently in your contact list and remove or block any that you do not know, do not trust or no longer need.

  • Do not agree to accept file transfers from contacts you do not know or trust.

  • Block access to MSN Messenger and Web Messenger in a corporate environment.

    1. Block access to outgoing port 1863 in your corporate environment. Note MSN Messenger Service is connected through port 1863 when a direct connection is established. When a direct connection cannot be established, the MSN Messenger Service is connected through port 80.
    2. Block HTTP access to messenger.hotmail.com. If you would like to block access to MSN Web Messenger you will also need to block HTTP access to webmessenger.msn.com.

    Impact of Workaround: MSN Messenger clients will not be able to connect to the MSN Messenger network

FAQ for PNG Processing Vulnerability in MSN Messenger - CAN-2004-0597:

Is the MSN Messenger 7.0 beta affected by this vulnerability?
No. This vulnerability was reported prior to the release of the MSN Messenger 7.0 beta, and is therefore already incorporated into that product version.

What is the scope of the vulnerability?
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

What causes the vulnerability?
MSN Messenger implements the public lipng 1.2.5 version library that is recently found to have several known vulnerabilities.

What is PNG?
PNG stands for Portable Network Graphics. The Portable Network Graphics (PNG) format was designed to replace the older and simpler GIF format and, to some extent, the much more complex TIFF format. Additional information about PNG can be found at the following Web site.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

Who could exploit the vulnerability?
An attacker would likely seek to exploit this vulnerability by convincing a user to add them to their contacts list, and sending a specially crafted emoticon or display picture.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative credentials are given the ability to log on to servers and run programs. However, best practices strongly discourage allowing this.

Are Windows 98, Windows 98 Second Edition or Windows Millennium Edition critically affected by this vulnerability?
Yes. Customers running an affected version of MSN Messenger should install the updated version of MSN Messenger.

What does the update do?
The update removes the vulnerability by updating the library used by MSN Messenger to one that correctly validates the PNG file being passed to it.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
These vulnerabilities have been publicly released and assigned Common Vulnerability and Exposure number CAN-2004-0597 .

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Security Update Information

Installation Platforms and Prerequisites:

For information about the specific security update for your platform, click the appropriate link:

Microsoft Windows Media Player 9 Series on Windows 2000, Windows XP and Windows Server 2003

Prerequisites This security update requires Windows Media Player 9 on Windows 2000 Service Pack 3 (SP3) or Service Pack 4 (SP4) or Windows XP Service Pack 1 (SP1) or Windows Server 2003.

The software that is listed has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support lifecycle for your product and version, visit the Microsoft Support Lifecycle Web site.

For more information about how to obtain the latest service pack, see Microsoft Knowledge Base Article 260910.

Inclusion in Future Service Packs: The update for this issue will be included in a future Service Pack or Update Rollup.

Installation Information

This security update supports the following setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

/integrate:path Integrates the update into the Windows source files located at the path specified

/extract Extracts files without starting setup

Note You can combine these switches into one command. For backward compatibility, the security update also supports the setup switches that the previous version of the setup utility uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841. For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows Media Player 9 Series on Windows 2000:

WindowsMediaPlayer9-KB885492-x86-enu /passive /quiet

To install the security update without forcing the system to restart, use the following command at a command prompt for Windows Media Player 9 Series on Windows XP and Windows Server 2003:

WindowsMediaPlayer9-KB885492-x86-enu /norestart

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

In some cases, this update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are in use, this update will require a restart. If this occurs, a message appears that advises you to restart.

Removal Information

To remove this update, use the Add or Remove Programs tool in Control Panel.

System administrators can also use the Spuninst.exe utility to remove this security update. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB885492$\Spuninst folder. The Spuninst.exe utility supports the following setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/f Force other programs to close when the computer shuts down

File Information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Microsoft Windows Media Player 9 Series on Windows 2000, Windows XP and Windows Server 2003:

File Name Version Date Time Size
Wmp.dll 9.0.0.3250 04-Aug-2004 07:56 4,874,240

Note When you install this security update on Windows Server 2003, the installer checks to see if any of the files that are being updated on your system have previously been updated by a Microsoft hotfix. If you have previously installed a hotfix to update an affected file, the installer copies the RTMQFE files to your system. Otherwise, the installer copies the RTMGDR files to your system.

For more information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

Verifying Update Installation

  • Microsoft Baseline Security Analyzer
    To verify that a security update is installed on an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. This tool allows administrators to scan local and remote systems for missing security updates and for common security misconfigurations. For more information about MBSA, visit the Microsoft Baseline Security Analyzer Web site.

  • File Version Verification
    Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.
    5. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table.
      Note Attributes other than file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying the update installation. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

  • Registry Key Verification
    You may also be able to verify the files that this security update has installed by reviewing the following registry key.

    Microsoft Windows Media Player 9 Series on Windows 2000, Windows XP and Windows Server 2003:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Player 9\kb885492

    Note This registry key may not contain a complete list of installed files. Also, this registry key may not be created correctly if an administrator or an OEM integrates or slipstreams the 885492 security update into the Windows installation source files.

Microsoft Windows Messenger 4.7.0.2009 on Windows XP Service Pack 1

Prerequisites This security update requires Microsoft Windows Messenger version 4.7.0.2009 (when running on Windows XP Service Pack 1)

Installation Information

This security update supports the following setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

/integrate:path Integrates the update into the Windows source files located at the path specified

/extract Extracts files without starting setup

Note You can combine these switches into one command. For backward compatibility, the security update also supports the setup switches that the previous version of the setup utility uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841. For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

For additional information about the supported setup switches, see Microsoft Knowledge Base Article 197147.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows XP Service Pack 1:

WindowsXP-KB887472-x86-SP1-enu /passive /quiet

To install the security update without forcing the system to restart, use the following command at a command prompt for Windows XP Service Pack 1:

WindowsXP-KB887472-x86-SP1-enu /norestart

For more information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

In some cases, this update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are in use, this update will require a restart. If this occurs, a message appears that advises you to restart.

Removal Information

This update cannot be uninstalled.

File Information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows Messenger version 4.7.0.2009 on Windows XP Service Pack 1:

File Name Version Date Time Size
Msmsgs.exe 4.7.0.2010 16-Nov-2004 00:18 1,670,144

Verifying Update Installation

  • Microsoft Baseline Security Analyzer
    To verify that a security update is installed on an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. This tool allows administrators to scan local and remote systems for missing security updates and for common security misconfigurations. For more information about MBSA, visit the Microsoft Baseline Security Analyzer Web site.

  • File Version Verification Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties.

    Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.

    1. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table.

    Note Attributes other than file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying the update installation. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

Microsoft Windows Messenger 4.7.0.3000 on Windows XP Service Pack 2

Prerequisites This security update requires Microsoft 4.7.0.3000 (when running on Windows XP Service Pack 2)

Inclusion in Future Service Packs: The update for this issue will be included in a future Service Pack or Update Rollup.

Installation Information

This security update supports the following setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

/integrate:path Integrates the update into the Windows source files located at the path specified

/extract Extracts files without starting setup

Note You can combine these switches into one command. For backward compatibility, the security update also supports the setup switches that the previous version of the setup utility uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841. For more information about the Update.exe installer, visit the Microsoft TechNet Web site.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows XP Service Pack 2:

WindowsXP-KB887472-x86-enu /passive /quiet

To install the security update without forcing the system to restart, use the following command at a command prompt for Windows XP Service Pack 2:

WindowsXP-KB887472-x86-enu /norestart

For more information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

In some cases, this update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are in use, this update will require a restart. If this occurs, a message appears that advises you to restart.

Removal Information

To remove this security update, use the Add or Remove Programs tool in Control Panel.

For Windows XP Service Pack 2: System administrators can also use the Spuninst.exe utility to remove this security update. The Spuninst.exe is located in the %Windir%\$NTUninstallKB887472$\Spuninst folder. The Spuninst.exe utility supports the following setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/f Force other programs to close when the computer shuts down

File Information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows Messenger version 4.7.0.3000 on Windows XP Service Pack 2:

File Name Version Date Time Size Folder
Msmsgs.exe 4.7.0.3001 13-Oct-2004 16:24 1,694,208 SP2GDR
Msmsgs.exe 4.7.0.3001 13-Oct-2004 16:21 1,694,208 SP2QFE

Verifying Update Installation

  • Microsoft Baseline Security Analyzer
    To verify that a security update is installed on an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. This tool allows administrators to scan local and remote systems for missing security updates and for common security misconfigurations. For more information about MBSA, visit the Microsoft Baseline Security Analyzer Web site.

  • File Version Verification
    Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.
    5. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table. Note Attributes other than file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying the update installation. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

  • Registry Key Verification
    You may also be able to verify the files that this security update has installed by reviewing the following registry keys.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB887472\Filelist

    Note These registry keys may not contain a complete list of installed files. Also, these registry keys may not be created correctly if an administrator or an OEM integrates or slipstreams the 887472 security update into the Windows installation source files.

Microsoft Windows Messenger 5.0

Prerequisites This security update requires Microsoft Windows 2000 Service Pack 4, Windows Server 2003, Windows XP Service Pack 1, or Windows XP Service Pack 2.

Installation Information

This security update is packaged using Windows Installer Version 3.0. For more information, see the product documentation.

Restart Requirement

In some cases, this update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are in use, this update will require a restart. If this occurs, a message appears that advises you to restart.

Removal Information

To remove this security update, use the Add or Remove Programs tool in Control Panel.

File Information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows Messenger 5.0 on Windows 2000 Service Pack 4, Windows Server 2003, Windows XP Service Pack 1, Windows XP Service Pack 2, or Windows XP Tablet PC Edition:

File Name Version Date Time Size
Msmsgs.exe 5.1.0.639 16-Nov-2004 09:30 1,611,480

Verifying Update Installation

  • Microsoft Baseline Security Analyzer
    To verify that a security update is installed on an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. This tool allows administrators to scan local and remote systems for missing security updates and for common security misconfigurations. For more information about MBSA, visit the Microsoft Baseline Security Analyzer Web site.

  • File Version Verification
    Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

    1. Click Start, and then click Search.
    2. In the Search Results pane, click All files and folders under Search Companion.
    3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
    4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties.

    Note Depending on the version of the operating system or programs installed, some of the files that are listed in the file information table may not be installed.

    1. On the Version tab, determine the version of the file that is installed on your computer by comparing it to the version that is documented in the appropriate file information table.

    Note Attributes other than file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying the update installation. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.

MSN Messenger 6.1 or 6.2

Prerequisites

This security update requires MSN Messenger 6.1 or 6.2.

Restart Requirement

This update may require you to restart your computer.

Removal Information

This update cannot be uninstalled.

Verifying Update Installation

To verify that a security update is installed on an affected system, please perform the following steps:

  1. Within MSN Messenger, Click Help, then About.
  2. Check the version number.

If the Version number reads 6.2.205 or above the update has been successfully installed.

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

Obtaining Other Security Updates:

Updates for other security issues are available from the following locations:

Support:

  • Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
  • International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Security Resources:

Software Update Services:

By using Microsoft Software Update Services (SUS), administrators can quickly and reliably deploy the latest critical updates and security updates to Windows 2000 and Windows Server 2003-based servers, and to desktop systems that are running Windows 2000 Professional or Windows XP Professional.

For more information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Systems Management Server:

Microsoft Systems Management Server (SMS) delivers a highly-configurable enterprise solution for managing updates. By using SMS, administrators can identify Windows-based systems that require security updates and to perform controlled deployment of these updates throughout the enterprise with minimal disruption to end users. For more information about how administrators can use SMS 2003 to deploy security updates, visit the SMS 2003 Security Patch Management Web site. SMS 2.0 users can also use Software Updates Service Feature Pack to help deploy security updates. For information about SMS, visit the SMS Web site.

Note SMS uses the Microsoft Baseline Security Analyzer, Microsoft Office Detection Tool and an Enterprise Update Scanning Tool to provide broad support for security bulletin update detection and deployment. Some software updates may not be detected by these tools. Administrators can use the inventory capabilities of the SMS in these cases to target updates to specific systems. For more information about this procedure, visit the following Web site. Some security updates require administrative rights following a restart of the system. Administrators can use the Elevated Rights Deployment Tool (available in the SMS 2003 Administration Feature Pack and in the SMS 2.0 Administration Feature Pack) to install these updates.

Disclaimer:

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:

  • V1.0 (February 8, 2005): Bulletin published
  • V1.1 (February 11, 2005): Bulletin updated with information on the mandatory upgrade of vulnerable MSN Messenger clients in the caveat section, as well as changes to the Workarounds for PNG Processing Vulnerability in MSN Messenger - CAN-2004-0597
  • V1.2 (February 15, 2005): Bulletin updated with correct file version information for Windows Messenger 5.0 update, as well as added Windows Messenger 5.1 to “Non-Affected Software” list.
  • V2.0 (April 12, 2005): Bulletin updated to announce the availability of an updated package for Microsoft Windows Messenger version 4.7.0.2009 (when running on Windows XP Service Pack 1)
  • V2.1 (May 11, 2005): Bulletin updated to update the “Security Update Information” section for the MSN Messenger 6.1 or 6.2 file version.
  • V2.2 (May 18, 2005): Updated the “Security Update Information” section for Microsoft Windows Messenger version 4.7.0.2009 with the correct command line example options.
  • V2.3 (May 25, 2005): Updated the “Security Update Information” section for Microsoft Windows Messenger version 4.7.0.2009 with the correct setup switches.
  • V2.4 (July 6, 2005): Updated the “Security Update Information” section for Microsoft Windows Messenger version 4.7.0.2009 with the package name in the setup switches.

Built at 2014-04-18T13:49:36Z-07:00