exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Visual C++ Runtime Libraries Out Of Date

Microsoft Visual C++ Runtime Libraries Out Of Date
Posted Jun 3, 2013
Authored by Stefan Kanthak

Many Microsoft products install outdated and vulnerable Microsoft Visual C++ Runtime Libraries MSVC?80.DLL version 8.0.50727.42.

tags | advisory
SHA-256 | 79d41b28c3cca91d28fadfcdc33dd2ddd6f4aeafcc354d1098eef8ce90448472

Microsoft Visual C++ Runtime Libraries Out Of Date

Change Mirror Download
Hi @ll,

this is part 2 of "Defense in depth -- the Microsoft way", see
<http://seclists.org/fulldisclosure/2013/May/107>


On Windows NT 5.x the current "Microsoft Security Essentials" v4.2
(available from <http://www.microsoft.com/security_essentials>,
and offered as optional update KB2804527 via "Microsoft Update)
as well as MANY other Microsoft products [*] install outdated and
vulnerable Microsoft Visual C++ Runtime Libraries MSVC?80.DLL
v8.0.50727.42


| C:\>filever /S %SystemRoot%\msvc?80.dll
| c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvc*
| --a-- W32i DLL ENU 8.0.50727.42 shp 479,232 09-22-2005 msvcm80.dll
| --a-- W32i DLL ENU 8.0.50727.42 shp 548,864 09-22-2005 msvcp80.dll
| --a-- W32i DLL ENU 8.0.50727.42 shp 626,688 09-22-2005 msvcr80.dll


These libraries come as part of the bundled component "Microsoft
Application Error Reporting"; its installer DW20Shared.msi contains
the outdated and vulnerable libraries (which are installed even if
a newer version is already present) in form of an MSI merge module
which in turn is part of Visual C++/Studio 2005 RTM, whose support
ended 2008-01-08, see
<http://support.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Visual+Studio+2005&Filter=FilterNO>

Current and supported versions of Visual C++/Studio 2005 SP1 come
with updated MSI merge modules, see
<http://support.microsoft.com/kb/2643995>


These libraries (as well as the MSI merge module) have been updated
multiple times since: see
<http://support.microsoft.com/kb/919588>
<http://support.microsoft.com/kb/923610>
<http://support.microsoft.com/kb/932391>
<http://support.microsoft.com/kb/932392>
<http://support.microsoft.com/kb/973544> (alias MS09-035)
<http://support.microsoft.com/kb/973882>
<http://support.microsoft.com/kb/2467175> (alias MS11-025)
<http://support.microsoft.com/kb/2538242> (alias MS11-025)


Due to the end-of-life condition of Visual C++/Studio 2005 RTM the
security bulletins MS09-035 and MS11-025 dont list these old versions
any more.


The FAQ section of
<http://technet.microsoft.com/en-us/security/bulletin/ms11-025> says:

| In the case where a system has no MFC applications currently installed
| but does have the vulnerable Visual Studio or Visual C++ runtimes
| installed, Microsoft recommends that users install this update as a
| defense-in-depth measure, in case of an attack vector being introduced
| or becoming known at a later time.

Of course the same holds for ATL applications (where MS09-035 recommends

| Developers who have built components and controls using ATL should
| download this update and recompile their components and controls
| following the guidance provided in the following MSDN article.

and refers to <http://msdn.microsoft.com/en-us/vstudio/ee309358.aspx>)
and CRT applications too.


The outdated and vulnerable libraries are NOT detected by the Windows
Update Agent and thus not replaced with their current version.


The VERY simple fix/mitigation: either uninstall DW20Shared.msi (run
MSIEXEC.EXE /X {95120000-00B9-0409-0000-0000000FF1CE})
or install the current MSVC++ 2005 Runtime Redistributable, see
<http://support.microsoft.com/kb/2538242>


Timeline:

2012-06-18 vendor informed

2012-06-20 vendor acknowledges receipt

2012-06-20 sent additional info (log files)

2012-08-01 vendor replies: not reproducible on Windows 7

2012-08-02 sent additional info: only Windows XP and Server 2003
are affected, can be seen in the log files sent before

2012-10-09 sent additional info: (3rd party) products which dont
ship a current MSVC++ 2005 Runtime are affected too

2012-11-29 vendor replies: not able to find vulnerabilities

2012-11-29 asked vendor what MS09-035 and MS11-025 are good for
then, and for the purpose of their recommendations and
FAQ

...

2013-06-03 report published


Stefan Kanthak


[*] DW20Shared.msi is bundled with numerous other Microsoft products too,
including

* Windows Defender
* Forefront Security ...
* Office 2003 (and every single component of it, Word, Excel, PowerPoint,
Outlook, Visio, Access, Publisher, OneNote, Project, ...)
* Office 2007 (and every single component of it, Word, Excel, PowerPoint,
Outlook, Visio, Access, Publisher, OneNote, Project, ...)
* Office 2010 (and every single component of it, Word, Excel, PowerPoint,
Outlook, Visio, Access, Publisher, OneNote, Project, ...)
* Office Communicator 2005
* Office Groove 2007
* Groove Server 2010
* Sharepoint Services 2.0
* Sharepoint Services 3.0
* SharePoint Designer 2007
* SharePoint Foundation 2010
* SharePoint Server 2010
* SQL Server 2005 Native Client
* SQL Server 2008 Native Client
* SQL Server 2010 Native Client
* SQL Server 2012 Native Client
* SQL Server Compact 3.5
* .NET Framework 2.0
* .NET Framework 3.0
* .NET Framework 3.5
...

Other products which dont ship with the MSVC++ 2005 Runtime
(like the MDI to TIFF converter, see
<http://www.microsoft.com/en-us/download/details.aspx?id=30328>)
use the outdated and vulnerable libraries too.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close