Microsoft Security Bulletin MS14-062 - Important

Vulnerability in Message Queuing Service Could Allow Elevation of Privilege (2993254)

Published: October 14, 2014

Version: 1.0

General Information

Executive Summary

This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker sends a specially crafted input/output control (IOCTL) request to the Message Queuing service. Successful exploitation of this vulnerability could lead to full access to the affected system. By default, the Message Queuing component is not installed on any affected operating system edition and can only be enabled by a user with administrative privileges. Only customers who manually enable the Message Queuing component are likely to be vulnerable to this issue.

This security update is rated Important for all supported editions of Windows Server 2003. For more information, see the Affected Software section.

The security update addresses the vulnerability by modifying how the Message Queuing service validates input data before passing the data to the allocated buffer. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability later in this bulletin.

Recommendation. Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871. For customers who do not have automatic updating enabled, the steps in Turn automatic updating on or off can be used to enable automatic updating.

For administrators and enterprise installations, or end users who want to install this security update manually (including customers who have not enabled automatic updating), Microsoft recommends that customers apply the update at the earliest opportunity using update management software, or by checking for updates using the Microsoft Update service. The updates are also available via the download links in the Affected Software table later in this bulletin.

For additional guidance, see the Detection and Deployment Tools and Guidance section in this bulletin.

Knowledge Base Article

  • Knowledge Base Article: 2993254
  • File Information: Yes
  • SHA1/SHA2 hashes: Yes
  • Known issues: None

 

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Operating System

Maximum Security Impact

Aggregate Severity Rating

Updates Replaced

Windows Server 2003

Windows Server 2003 Service Pack 2
(2993254)

Elevation of Privilege

Important

971032 in MS09-040

Windows Server 2003 x64 Edition Service Pack 2
(2993254)

Elevation of Privilege

Important

971032 in MS09-040

Windows Server 2003 with SP2 for Itanium-based Systems
(2993254)

Elevation of Privilege

Important

971032 in MS09-040

 

I am using an older release of the software discussed in this security bulletin. What should I do? 
The affected software listed in this bulletin has been tested to determine which releases are affected. Other releases are past their support life cycle. For more information about the product lifecycle, see the Microsoft Support Lifecycle website.

It should be a priority for customers who have older releases of the software to migrate to supported releases to prevent potential exposure to vulnerabilities. To determine the support lifecycle for your software release, see Select a Product for Lifecycle Information. For more information about service packs for these software releases, see Service Pack Lifecycle Support Policy.

Customers who require custom support for older software must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, see the Microsoft Worldwide Information website, then select the country to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Microsoft Support Lifecycle Policy FAQ.

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the October bulletin summary. For more information, see Microsoft Exploitability Index.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software

Affected Software

MQAC Arbitrary Write Privilege Escalation Vulnerability - CVE-2014-4971

Aggregate Severity Rating

Windows Server 2003

Windows Server 2003 Service Pack 2
(2993254)

Important 
Elevation of Privilege

Important

Windows Server 2003 x64 Edition Service Pack 2
(2993254)

Important 
Elevation of Privilege

Important

Windows Server 2003 with SP2 for Itanium-based Systems
(2993254)

Important 
Elevation of Privilege

Important

 

A vulnerability exists in the Microsoft Message Queuing (MSMQ) service that could allow an attacker to elevate privileges on the targeted system.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2014-4971.

Mitigating Factors

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

  • By default, the Message Queuing component is not installed on any affected operating system edition and can only be enabled by a user with administrative privileges. Only customers who manually enable the Message Queuing component are likely to be vulnerable to this issue.
  • An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Workarounds

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

Disable the Message Queuing Service:

  • Interactively

    Disabling the Message Queuing service will help protect the affected system from attempts to exploit this vulnerability. To disable the Message Queuing service, follow these steps:

    1. Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.
    2. Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.
    3. Double-click Services.
    4. Double-click Message Queuing.
    5. In the Startup type list, click Disabled.
    6. Click Stop, and then click OK.
       
  • By Group Policy:

    Disable the Message Queuing service by using the Group Policy settings. You can disable the startup of this service at either the local, site, domain, or organizational-unit level by using Group Policy object functionality in Microsoft Windows 2000 domain environments or in Windows Server 2003 domain environments.

    Note You may also review the Windows Server 2003 Security Guide. This guide includes information about how to disable services.
    For more information about Group Policy, visit the following Microsoft websites:

  • You can also stop and disable the MSMQ service by using the following command at the command prompt (available in Windows XP and in the Microsoft Windows 2000 Resource Kit):
    Sc stop MSMQ & sc config MSMQ start= disabled
    

How to undo the workaround: Use the steps above to set the Startup Type to Automatic and start the service.

FAQ

What is the scope of the vulnerability? 
This is an elevation of privilege vulnerability.

What causes the vulnerability? 
The vulnerability is caused when the Message Queuing service improperly handles objects in memory by inadvertently allowing overwrite.

What is Microsoft Message Queuing (MSMQ)? 
Microsoft Message Queuing (MSMQ) technology enables applications that are running at different times to communicate across heterogeneous networks and across systems that may be temporarily offline. Applications send messages to queues and read messages from queues. Message Queuing provides guaranteed message delivery, efficient routing, security, and priority-based messaging. It can be used to implement solutions for both asynchronous and synchronous messaging scenarios. For more information, see the Microsoft Message Queuing product documentation.

What is an input/output control (IOCTL)? 
Windows provides the ability for applications to directly request services of device drivers. The interface through which this is done is called an input/output control, or IOCTL.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

How could an attacker exploit the vulnerability? 
An attacker could exploit this vulnerability by sending a specially crafted IOCTL request to the Message Queuing service. Successful exploitation of this vulnerability could lead to full access to the affected system.

What systems are primarily at risk from the vulnerability? 
Workstations and servers running the Message Queuing service are primarily at risk from this vulnerability.

What does the update do? 
The update addresses the vulnerability by modifying how the MSMQ service validates input data before passing the data to the allocated buffer.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2014-4971.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Several resources are available to help administrators deploy security updates. 

  • Microsoft Baseline Security Analyzer (MBSA) lets administrators scan local and remote systems for missing security updates and common security misconfigurations. 
  • Windows Server Update Services (WSUS), Systems Management Server (SMS), and System Center Configuration Manager help administrators distribute security updates. 
  • The Update Compatibility Evaluator components included with Application Compatibility Toolkit aid in streamlining the testing and validation of Windows updates against installed applications. 

For information about these and other tools that are available, see Security Tools for IT Pros

Windows Server 2003 (all editions)

Reference Table

The following table contains the security update information for this software.

Security update file names

For all supported 32-bit editions of Windows Server 2003:
WindowsServer2003-KB2993254-x86-ENU.exe


For all supported x64-based editions of Windows Server 2003:
WindowsServer2003-KB2993254-x64-ENU.exe


For all supported Itanium-based editions of Windows Server 2003:
WindowsServer2003-KB2993254-ia64-ENU.exe

Installation switches

See Microsoft Knowledge Base Article 934307

Update Log File

KB2993254.log

Restart requirement

Yes, you must restart your system after you apply this security update.

Removal information

Use Add or Remove Programs item in Control Panel or the Spuninst.exe utility located in the %Windir%\$NTUninstallKB2993254$\Spuninst folder

File information

See Microsoft Knowledge Base Article 2993254

Registry key verification

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP3\KB2993254\Filelist

 

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please go to the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Support

How to obtain help and support for this security update

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (October 14, 2014): Bulletin published.

Page generated 2014-10-07 14:53Z-07:00.
Show: