|CERT-In Vulnerability Note
Microsoft Windows Internet Authentication Service Remote Code Execution Vulnerabilities
Original Issue Date:December 09, 2009
Severity Rating: HIGH
- Microsoft Windows 2000 SP 4
- Microsoft Windows XP SP 2 and SP 3
- Microsoft Windows XP Professional x64 Edition Service Pack 2
- Microsoft Windows Server 2003 Service Pack 2
- Microsoft Windows Server 2003 x64 Edition Service Pack 2
- Microsoft Windows Server 2003 SP2 for Itanium based systems
- Microsoft Windows Vista
- Microsoft Windows Vista Service Pack 1
- Microsoft Windows Vista x64 Edition
- Microsoft Windows Vista x64 Edition Service Pack 1
- Microsoft Windows Server 2008
- Microsoft Windows Server 2008 for Itanium based systems
Two remote code execution vulnerabilities have been in reported Microsoft Windows Internet Authentication Service. Successful exploitation of any of these vulnerabilities could results in remote execution of arbitrary code.
1. Internet Authentication Service Memory Corruption Vulnerability
The vulnerability exists due to the error in handling malformed Protected Extensible Authentication Protocol PEAP authentication request by IAS. A remote attacker could exploit this vulnerability by sending malformed PEAP authentication requests to IAS server, that will result in arbitrary code execution.
2. MS-CHAP Authentication Bypass Vulnerability
The vulnerability exists due to error in handling malformed MS-CHAP v2 authentication request. A remote attacker could exploit this vulnerability by sending malformed MS-CHAP v2 authentication requests to IAS server.
- Use an authentication protocol other than PEAP with MS-CHAP v2 on your Internet Authentication Service server
For detailed steps and impact of applying these workarounds refer to Microsoft Security bulletin MS09- 071
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
The information provided herein is on "as is" basis, without warranty of any kind.
Email: firstname.lastname@example.org Phone: +91-11-2436857
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
6, CGO Complex, Lodhi Road,
New Delhi - 110 003