the original cloud security

Microsoft Visual C++ Runtime Libraries Out Of Date

Microsoft Visual C++ Runtime Libraries Out Of Date
Posted Jun 3, 2013
Authored by Stefan Kanthak

Many Microsoft products install outdated and vulnerable Microsoft Visual C++ Runtime Libraries MSVC?80.DLL version 8.0.50727.42.

tags | advisory
MD5 | cdb114237f15df97de4b22bc235ebc48

Microsoft Visual C++ Runtime Libraries Out Of Date

Change Mirror Download
Hi @ll,

this is part 2 of "Defense in depth -- the Microsoft way", see
<http://seclists.org/fulldisclosure/2013/May/107>


On Windows NT 5.x the current "Microsoft Security Essentials" v4.2
(available from <http://www.microsoft.com/security_essentials>,
and offered as optional update KB2804527 via "Microsoft Update)
as well as MANY other Microsoft products [*] install outdated and
vulnerable Microsoft Visual C++ Runtime Libraries MSVC?80.DLL
v8.0.50727.42


| C:\>filever /S %SystemRoot%\msvc?80.dll
| c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvc*
| --a-- W32i DLL ENU 8.0.50727.42 shp 479,232 09-22-2005 msvcm80.dll
| --a-- W32i DLL ENU 8.0.50727.42 shp 548,864 09-22-2005 msvcp80.dll
| --a-- W32i DLL ENU 8.0.50727.42 shp 626,688 09-22-2005 msvcr80.dll


These libraries come as part of the bundled component "Microsoft
Application Error Reporting"; its installer DW20Shared.msi contains
the outdated and vulnerable libraries (which are installed even if
a newer version is already present) in form of an MSI merge module
which in turn is part of Visual C++/Studio 2005 RTM, whose support
ended 2008-01-08, see
<http://support.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Visual+Studio+2005&Filter=FilterNO>

Current and supported versions of Visual C++/Studio 2005 SP1 come
with updated MSI merge modules, see
<http://support.microsoft.com/kb/2643995>


These libraries (as well as the MSI merge module) have been updated
multiple times since: see
<http://support.microsoft.com/kb/919588>
<http://support.microsoft.com/kb/923610>
<http://support.microsoft.com/kb/932391>
<http://support.microsoft.com/kb/932392>
<http://support.microsoft.com/kb/973544> (alias MS09-035)
<http://support.microsoft.com/kb/973882>
<http://support.microsoft.com/kb/2467175> (alias MS11-025)
<http://support.microsoft.com/kb/2538242> (alias MS11-025)


Due to the end-of-life condition of Visual C++/Studio 2005 RTM the
security bulletins MS09-035 and MS11-025 dont list these old versions
any more.


The FAQ section of
<http://technet.microsoft.com/en-us/security/bulletin/ms11-025> says:

| In the case where a system has no MFC applications currently installed
| but does have the vulnerable Visual Studio or Visual C++ runtimes
| installed, Microsoft recommends that users install this update as a
| defense-in-depth measure, in case of an attack vector being introduced
| or becoming known at a later time.

Of course the same holds for ATL applications (where MS09-035 recommends

| Developers who have built components and controls using ATL should
| download this update and recompile their components and controls
| following the guidance provided in the following MSDN article.

and refers to <http://msdn.microsoft.com/en-us/vstudio/ee309358.aspx>)
and CRT applications too.


The outdated and vulnerable libraries are NOT detected by the Windows
Update Agent and thus not replaced with their current version.


The VERY simple fix/mitigation: either uninstall DW20Shared.msi (run
MSIEXEC.EXE /X {95120000-00B9-0409-0000-0000000FF1CE})
or install the current MSVC++ 2005 Runtime Redistributable, see
<http://support.microsoft.com/kb/2538242>


Timeline:

2012-06-18 vendor informed

2012-06-20 vendor acknowledges receipt

2012-06-20 sent additional info (log files)

2012-08-01 vendor replies: not reproducible on Windows 7

2012-08-02 sent additional info: only Windows XP and Server 2003
are affected, can be seen in the log files sent before

2012-10-09 sent additional info: (3rd party) products which dont
ship a current MSVC++ 2005 Runtime are affected too

2012-11-29 vendor replies: not able to find vulnerabilities

2012-11-29 asked vendor what MS09-035 and MS11-025 are good for
then, and for the purpose of their recommendations and
FAQ

...

2013-06-03 report published


Stefan Kanthak


[*] DW20Shared.msi is bundled with numerous other Microsoft products too,
including

* Windows Defender
* Forefront Security ...
* Office 2003 (and every single component of it, Word, Excel, PowerPoint,
Outlook, Visio, Access, Publisher, OneNote, Project, ...)
* Office 2007 (and every single component of it, Word, Excel, PowerPoint,
Outlook, Visio, Access, Publisher, OneNote, Project, ...)
* Office 2010 (and every single component of it, Word, Excel, PowerPoint,
Outlook, Visio, Access, Publisher, OneNote, Project, ...)
* Office Communicator 2005
* Office Groove 2007
* Groove Server 2010
* Sharepoint Services 2.0
* Sharepoint Services 3.0
* SharePoint Designer 2007
* SharePoint Foundation 2010
* SharePoint Server 2010
* SQL Server 2005 Native Client
* SQL Server 2008 Native Client
* SQL Server 2010 Native Client
* SQL Server 2012 Native Client
* SQL Server Compact 3.5
* .NET Framework 2.0
* .NET Framework 3.0
* .NET Framework 3.5
...

Other products which dont ship with the MSVC++ 2005 Runtime
(like the MDI to TIFF converter, see
<http://www.microsoft.com/en-us/download/details.aspx?id=30328>)
use the outdated and vulnerable libraries too.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    2 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close