Article
06/08/2023

Security Bulletin

Microsoft Security Bulletin MS09-012 - Important

Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)

Published: April 14, 2009 | Updated: April 29, 2009

Version: 2.0

General Information

Executive Summary

This security update resolves four publicly disclosed vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker is allowed to log on to the system and then run a specially crafted application. The attacker must be able to run code on the local machine in order to exploit this vulnerability. An attacker who successfully exploited any of these vulnerabilities could take complete control over the affected system.

This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerabilities by correcting the way that Microsoft Windows addresses tokens requested by the Microsoft Distributed Transaction Coordinator (MSDTC), and by properly isolating WMI providers and processes that run under the NetworkService or LocalService accounts. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 951306.

Recommendation. The majority of customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update at the earliest opportunity using update management software, or by checking for updates using the Microsoft Update service.

See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.

Known Issues. Microsoft Knowledge Base Article 959454 documents the currently known issues that customers may experience when installing this security update. The article also documents recommended solutions for these issues.

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

Affected Software

MSDTC Transaction Facility update	Windows Service Isolation update	Maximum Security Impact	Aggregate Severity Rating	Bulletins Replaced by this Update
Microsoft Windows 2000 Service Pack 4\ (KB952004)	Not applicable	Elevation of Privilege	Important	None
Windows XP Service Pack 2 and Windows XP Service Pack 3\ (KB952004)	See rows below	Elevation of Privilege	Important	None
See row above	Windows XP Service Pack 2\ (KB956572)	Elevation of Privilege	Important	MS07-022,\ MS08-002,\ MS08-064
See row above	Windows XP Service Pack 3\ (KB956572)	Elevation of Privilege	Important	MS08-064
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2\ (KB956572)	Elevation of Privilege	Important	MS08-002,\ MS08-064
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2\ (KB956572)	Elevation of Privilege	Important	MS07-022,\ MS08-002,\ MS08-064\
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2\ (KB956572)	Elevation of Privilege	Important	MS08-002,\ MS08-064
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems\ (KB956572)	Elevation of Privilege	Important	MS08-002,\ MS08-064
Windows Vista and Windows Vista Service Pack 1\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Vista and Windows Vista Service Pack 1\ (KB956572)	Elevation of Privilege	Important	MS08-064
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1\ (KB956572)	Elevation of Privilege	Important	MS08-064
Windows Server 2008 for 32-bit Systems*\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Server 2008 for 32-bit Systems*\ (KB956572)	Elevation of Privilege	Important	MS08-064
Windows Server 2008 for x64-based Systems*\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Server 2008 for x64-based Systems*\ (KB956572)	Elevation of Privilege	Important	MS08-064
Windows Server 2008 for Itanium-based Systems\ (KB952004)	See row below	Elevation of Privilege	Important	None
See row above	Windows Server 2008 for Itanium-based Systems\ (KB956572)	Elevation of Privilege	Important	MS08-064

*Windows Server 2008 server core installation affected. For supported editions of Windows Server 2008, this update applies, with the same severity rating, whether or not Windows Server 2008 was installed using the Server Core installation option. For more information on this installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Why was this bulletin revised on April 29, 2009?
Microsoft revised this bulletin to communicate the rerelease of the Norwegian-language update for Microsoft Windows 2000 Service Pack 4 (KB952004) to fix a quality issue that could cause the installation to fail. Customers who have downloaded and attempted to install the Norwegian-language update need to download and install the rereleased update to be protected from the vulnerabilities described in this bulletin. No other updates or locales are affected by this rerelease.

Why was this bulletin revised on April 22, 2009?
This bulletin was revised to communicate that the Known issues with this security update section referenced in the associated Microsoft Knowledge Base Article 959454 has been updated to describe an application compatibility issue with this update and systems running Microsoft Internet Security and Acceleration (ISA) Server 2000 Standard Edition, Microsoft Internet Security and Acceleration (ISA) Server 2004 Standard Edition, or Microsoft Internet Security and Acceleration (ISA) Server 2006 Standard Edition.

Where are the file information details?
The file information details can be found in Microsoft Knowledge Base Article 959454.

What are the known issues that customers may experience when installing this security update?
Microsoft Knowledge Base Article 959454 documents the currently known issues that customers may experience when they install this security update. The article also documents recommended solutions for these issues.

Why does this bulletin contain two updates for each affected operating system?
This bulletin contains two updates, identified by KB number, for all affected operating systems. Customers of Microsoft Windows 2000 only need to apply update package KB952004. Customers running other affected operating systems need to apply security update packages KB952004 and KB956572 for each operating system as applies in their environment.

The two updates are necessary for most affected operating systems because the modifications that are required to address the vulnerabilities are located in separate components. KB952004 addresses the publicly known issue in the MSDTC transaction facility. KB956572 provides the architectural changes needed to ensure proper service isolation across other services on Windows platforms.

Why does this update address several reported security vulnerabilities?
This update contains support for several vulnerabilities because the modifications that are required to address these issues are located in related files. Instead of having to install several updates that are almost the same, customers need to install this update only.

Does this update contain any security-related changes to functionality?
Yes. Besides the changes that are listed in the Vulnerability Information section of this bulletin, this security update also provides an infrastructure to isolate and secure services. In Windows XP and Windows Server 2003, all processes running under the context of a single account will have full control over each other. This update provides third parties the ability to isolate and secure their services that hold SYSTEM tokens and run under the NetworkService or LocalService accounts. For more information on the usage of this registry key, see Microsoft Knowledge Base Article 956572.

I am using an older release of the software discussed in this security bulletin. What should I do?
The affected software listed in this bulletin have been tested to determine which releases are affected. Other releases are past their support life cycle. To determine the support life cycle for your software release, visit Microsoft Support Lifecycle.

It should be a priority for customers who have older releases of the software to migrate to supported releases to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit Microsoft Support Lifecycle. For more information about the extended security update support period for these software versions or editions, visit Microsoft Product Support Services.

Customers who require custom support for older releases must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, visit Microsoft Worldwide Information, select the country, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Windows Operating System Product Support Lifecycle FAQ.

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the April bulletin summary. For more information, see Microsoft Exploitability Index.

Affected Software	Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436	Windows WMI Service Isolation Vulnerability - CVE-2009-0078	Windows RPCSS Service Isolation Vulnerability - CVE-2009-0079	Windows Thread Pool ACL Weakness Vulnerability - CVE-2009-0080	Aggregate Severity Rating
Microsoft Windows 2000 Service Pack 4	Important \ Elevation of Privilege	Not applicable	Not applicable	Not applicable	Important
Windows XP Service Pack 2 and Windows XP Service Pack 3	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important
Windows Vista and Windows Vista Service Pack 1	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important \ Elevation of Privilege	Important
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important \ Elevation of Privilege	Important
Windows Server 2008 for 32-bit Systems*	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important \ Elevation of Privilege	Important
Windows Server 2008 for x64-based Systems*	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important \ Elevation of Privilege	Important
Windows Server 2008 for Itanium-based Systems	Important \ Elevation of Privilege	Important \ Elevation of Privilege	Not applicable	Important \ Elevation of Privilege	Important

Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

An elevation of privilege vulnerability exists in the Microsoft Distributed Transaction Coordinator (MSDTC) transaction facility in Microsoft Windows platforms. MSDTC leaves a NetworkService token that can be impersonated by any process that calls into it. The vulnerability allows a process that is not running under the NetworkService account, but that has the SeImpersonatePrivilege, to elevate its privilege to NetworkService and execute code with NetworkService privileges. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2008-1436.

Mitigating Factors for Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

The attacker must be able to run code on the local machine to exploit this vulnerability.

Workarounds for Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

IIS 6.0 - Configure a Worker Process Identity (WPI) for an application pool in IIS to use a created account in IIS Manager and disable MSDTC

Perform the following steps:
1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool and select Properties.
2. Click the Identity tab and click Configurable. In the User name and Password boxes, type the user name and password of the account under which you want the worker process to operate.
3. Add the chosen user account to the IIS_WPG group.
Disabling the Distributed Transaction Coordinator will help protect the affected system from attempts to exploit this vulnerability. To disable the Distributed Transaction Coordinator, perform these steps:
1. Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.
2. Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.
3. Double-click Services.
4. Double-click Distributed Transaction Coordinator.
5. In the Startup type list, click Disabled.
6. Click Stop (if started), and then click OK.
You can also stop and disable the MSDTC service by using the following command at the command prompt:
sc stop MSDTC & sc config MSDTC start= disabled

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected. An example is Windows Authentication; see Microsoft Knowledge Base Article 871179. Disabling MSDTC will prevent applications from using distributed transactions. Disabling MSDTC will prevent IIS 5.1 from running in Windows XP Professional Service Pack 2 and Windows XP Professional Service Pack 3, and IIS 6.0 running in IIS 5.0 compatibility mode. Disabling MSDTC will prevent configuration as well as running of COM+ applications.
IIS 7.0 - Specify a WPI for an application pool in IIS Manager
1. In IIS Manager, expand the server node, click Application Pools, right-click the application pool, and then click Advanced Settings…
2. Find the Identity entry, and click the … button to open the Application Pool Identity dialog box.
3. Select the Custom account option and click Set to open the Set Credentials dialog box. Type in the selected Account name and Password in the user name and password text boxes. Retype the Password in the Confirm password text box, then click OK.
Note Application pool identities are dynamically added to IIS_WPG group in IIS7 and don’t need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.
IIS 7.0 - Specify a WPI for an application pool using the Command Line utility, APPCMD.exe
1. From an elevated command prompt, change to the %systemroot%\system32\inetsrv directory.
2. Execute the APPCMD.exe command using the following syntax where string is the name of the application pool; userName:string is the user name of the account assigned to the application pool; and password:string is the password for the account.
  appcmd set config /section:applicationPools /
  [name='string'].processModel.identityType:SpecificUser /
  [name='string'].processModel.userName:string /
  [name='string'].processModel.password:string
Note Application pool identities are dynamically added to IIS_WPG group in IIS 7.0 and do not need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.

FAQ for Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

What is the scope of the vulnerability?
This is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could execute arbitrary code with NetworkService privileges. An attacker could then obtain the LocalSystem token from other vulnerable services and install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability?
The vulnerability is due to the Microsoft Distributed Transaction Coordinator (MSDTC) transaction facility allowing the NetworkService token to be obtained and used when making an RPC call.

What is the Microsoft Distributed Transaction Coordinator?
The Microsoft Distributed Transaction Coordinator (MSDTC) is a distributed transaction facility for Microsoft Windows platforms. MSDTC uses proven transaction processing technology. It is robust despite system failures, process failures, and communication failures; it exploits loosely coupled systems to provide scalable performance; and it is easy to install, configure, and manage.

For more information about MSDTC, see the MSDN article, DTC Developers Guide.

What is RPC?
Remote Procedure Call (RPC) is a protocol that a program can use to request a service from a program located on another computer in a network. RPC helps with interoperability because the program using RPC does not have to understand the network protocols that are supporting communication. In RPC, the requesting program is the client and the service-providing program is the server.

What is the NetworkService Account?
The NetworkService account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and acts as the computer on the network. A service that runs in the context of the NetworkService account presents the computer's credentials to remote servers. For more information, see the MSDN article, NetworkService Account.

What is the LocalService Account?
The LocalService account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and presents anonymous credentials on the network. For information, see the MSDN article, LocalService Account.

What is the LocalSystem Account?
The LocalSystem account is a predefined local account used by the service control manager. It has extensive privileges on the local computer, and acts as the computer on the network. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects. A service that runs in the context of the LocalSystem account inherits the security context of the Service Control Manager. Most services do not need such a high privilege level. For more information, see the MSDN article, LocalSystem Account.

How is IIS affected by this issue?
Systems running user-provided code in Internet Information Services (IIS) may be affected. For example ISAPI filters and extensions, and ASP.NET code running in full trust may be affected by this vulnerability.

IIS is not affected in the following scenarios:

Default Installations of IIS 5.1, IIS 6.0, and IIS 7.0
ASP.NET configured to run with a trust level lower than Full Trust

How is SQL Server affected by this issue?
Systems running SQL Server may be affected if a user is granted administrative privileges to load and run code. A user with SQL Server administrator privileges could execute specially crafted code that could leverage the attack. However, this privilege is not granted by default.

What additional applications may be affected by this vulnerability?
Systems running any process with SeImpersonatePrivilege that loads and runs user-provided code may be susceptible to an elevation of privilege attack as described in this security bulletin. The SeImpersonatePrivilege setting is described in Microsoft Knowledge Base Article 821546.

How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take complete control over the affected system.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have administrative permissions are given the ability to log on to servers and to run programs. However, best practices strongly discourage allowing this.

All systems running all supported editions of Windows XP Professional Service Pack 2 and Windows XP Professional Service Pack 3, and all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008 may be at risk if IIS is enabled or SQL Server is installed and configured or deployed in a vulnerable state as described in this bulletin.

In addition, IIS systems that allow users to upload code are at increased risk. SQL Server systems are at risk if untrusted users are granted privileged account access. This may include Web hosting providers or similar environments.

What does the update do?
The update addresses the vulnerability by reducing the privilege level on the token requested by MSDTC.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2008-1436.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
Yes. Microsoft is aware of limited, targeted attacks attempting to exploit the vulnerability.

Does applying this security update help protect customers from the code, published publicly, that attempts to exploit this vulnerability?
Yes. This security update addresses the vulnerability that is currently being exploited. The vulnerability that has been addressed has been assigned the Common Vulnerability and Exposure number CVE-2008-1436.

Windows WMI Service Isolation Vulnerability - CVE-2009-0078

An elevation of privilege vulnerability exists due to the Windows Management Instrumentation (WMI) provider improperly isolating processes that run under the NetworkService or LocalService accounts. The vulnerability could allow an attacker to run code with elevated privileges. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2009-0078.

Mitigating Factors for Windows WMI Service Isolation Vulnerability - CVE-2009-0078

The attacker must be able to run code on the local machine to exploit this vulnerability.

Workarounds for Windows WMI Service Isolation Vulnerability - CVE-2009-0078

IIS 6.0 - Configure a Worker Process Identity (WPI) for an application pool in IIS to use a created account in IIS Manager and disable MSDTC

Perform the following steps:
1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool and select Properties.
2. Click the Identity tab and click Configurable. In the User name and Password boxes, type the user name and password of the account under which you want the worker process to operate.
3. Add the chosen user account to the IIS_WPG group.
Disabling the Distributed Transaction Coordinator will help protect the affected system from attempts to exploit this vulnerability. To disable the Distributed Transaction Coordinator, perform these steps:
1. Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.
2. Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.
3. Double-click Services.
4. Double-click Distributed Transaction Coordinator.
5. In the Startup type list, click Disabled.
6. Click Stop (if started), and then click OK.
You can also stop and disable the MSDTC service by using the following command at the command prompt:
sc stop MSDTC & sc config MSDTC start= disabled

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected. An example is Windows Authentication; see Microsoft Knowledge Base Article 871179. Disabling MSDTC will prevent applications from using distributed transactions. Disabling MSDTC will prevent IIS 5.1 from running in Windows XP Professional Service Pack 2 and Windows XP Professional Service Pack 3, and IIS 6.0 running in IIS 5.0 compatibility mode. Disabling MSDTC will prevent configuration as well as running of COM+ applications.
IIS 7.0 - Specify a WPI for an application pool in IIS Manager
1. In IIS Manager, expand the server node, click Application Pools, right-click the application pool, and then click Advanced Settings…
2. Find the Identity entry, and click the … button to open the Application Pool Identity dialog box.
3. Select the Custom account option and click Set to open the Set Credentials dialog box. Type in the selected Account name and Password in the user name and password text boxes. Retype the Password in the Confirm password text box, then click OK.
Note Application pool identities are dynamically added to IIS_WPG group in IIS7 and don’t need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.
IIS 7.0 - Specify a WPI for an application pool using the Command Line utility APPCMD.exe
1. From an elevated command prompt, change to the %systemroot%\system32\inetsrv directory.
2. Execute the APPCMD.exe command using the following syntax where string is the name of the application pool; userName:string is the user name of the account assigned to the application pool; and password:string is the password for the account.
  appcmd set config /section:applicationPools /
  [name='string'].processModel.identityType:SpecificUser /
  [name='string'].processModel.userName:string /
  [name='string'].processModel.password:string
Note Application pool identities are dynamically added to IIS_WPG group in IIS 7.0 and do not need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.

FAQ for Windows WMI Service Isolation Vulnerability - CVE-2009-0078

What is the scope of the vulnerability?
This is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could execute arbitrary code with the same privileges as the LocalSystem account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability?
The vulnerability is due to Windows Management Instrumentation (WMI) provider improperly isolating processes that run under the NetworkService or LocalService accounts. Two separate processes running under same account have full access to each other’s resources such as file handle, registry keys, handles,and so on. The WMI provider host process holds SYSTEM Tokens in certain scenarios. If an attacker gains access to a computer under the context of a NetworkService or LocalService account, the attacker can execute code to probe the WMI provider host processes for SYSTEM tokens. Once a SYSTEM token is found, the attacker's code can use it to gain SYSTEM level privileges.

What is the Windows Management Instrumentation (WMI)?
Windows Management Instrumentation (WMI) is the primary management technology for Microsoft Windows operating systems. It enables consistent and uniform management, control, and monitoring of systems throughout your enterprise. WMI allows system administrators to query, change, and monitor configuration settings on desktop and server systems, applications, networks, and other enterprise components. For more information, see WMI Scripting Primer.

IIS is not affected in the following scenarios:

Default Installations of IIS 5.1, IIS 6.0, and IIS 7.0
ASP.NET configured to run with a trust level lower than Full Trust

Which WMI providers are impacted by this update?
A complete list of WMI providers impacted by this can update can be found in Microsoft Knowledge Base Article 956572.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could run specially crafted code in the context of the NetworkService or LocalService accounts that could gain access to resources in processes that are also running as NetworkService or LocalService. Some of these processes may have the ability to elevate their privileges to LocalSystem, allowing any NetworkService or LocalService processes to elevate their privileges to LocalSystem as well. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would first have to convince a logged-on user to execute code on their system. An attacker could then run a specially crafted application that could exploit the vulnerability and take complete control over the affected system.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative permissions are given the ability to log on to servers and to run programs. However, best practices strongly discourage allowing this.

All systems running all supported editions of Windows XP Professional Service Pack 2, Windows XP Professional Service Pack 3, and all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008 may be at risk if IIS is enabled or SQL Server is installed and configured or deployed in a vulnerable state as described by this bulletin.

What does the update do?
The update addresses the vulnerability by properly isolating WMI providers to ensure they are invoked in a secure manner.

Windows RPCSS Service Isolation Vulnerability - CVE-2009-0079

An elevation of privilege vulnerability exists due to the RPCSS service improperly isolating processes that run under the NetworkService or LocalService accounts. The vulnerability could allow an attacker to run code with elevated privileges. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2009-0079.

Mitigating Factors for Windows RPCSS Service Isolation Vulnerability - CVE-2009-0079

The attacker must be able to run code on the local machine to exploit this vulnerability.

Workarounds for Windows RPCSS Service Isolation Vulnerability - CVE-2009-0079

IIS 6.0 - Configure a Worker Process Identity (WPI) for an application pool in IIS to use a created account in IIS Manager and disable MSDTC

Perform the following steps:
1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool and select Properties.
2. Click the Identity tab and click Configurable. In the User name and Password boxes, type the user name and password of the account under which you want the worker process to operate.
3. Add the chosen user account to the IIS_WPG group.
Disabling the Distributed Transaction Coordinator will help protect the affected system from attempts to exploit this vulnerability. To disable the Distributed Transaction Coordinator, perform these steps:
1. Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.
2. Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.
3. Double-click Services.
4. Double-click Distributed Transaction Coordinator.
5. In the Startup type list, click Disabled.
6. Click Stop (if started), and then click OK.
You can also stop and disable the MSDTC service by using the following command at the command prompt:
sc stop MSDTC & sc config MSDTC start= disabled

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected. An example is Windows Authentication; see Microsoft Knowledge Base Article 871179. Disabling MSDTC will prevent applications from using distributed transactions. Disabling MSDTC will prevent IIS 5.1 from running in Windows XP Professional Service Pack 2 and Windows XP Professional Service Pack 3, and IIS 6.0 running in IIS 5.0 compatibility mode. Disabling MSDTC will prevent configuration as well as running of COM+ applications.
IIS 7.0 - Specify a WPI for an application pool in IIS Manager
1. In IIS Manager, expand the server node, click Application Pools, right-click the application pool, and then click Advanced Settings…
2. Find the Identity entry, and click the … button to open the Application Pool Identity dialog box.
3. Select the Custom account option and click Set to open the Set Credentials dialog box. Type in the selected Account name and Password in the user name and password text boxes. Retype the Password in the Confirm password text box, then click OK.
Note Application pool identities are dynamically added to IIS_WPG group in IIS7 and don’t need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.
IIS 7.0 - Specify a WPI for an application pool using the Command Line utility APPCMD.exe
1. From an elevated command prompt, change to the %systemroot%\system32\inetsrv directory.
2. Execute the APPCMD.exe command using the following syntax where string is the name of the application pool; userName:string is the user name of the account assigned to the application pool; and password:string is the password for the account.
  appcmd set config /section:applicationPools /
  [name='string'].processModel.identityType:SpecificUser /
  [name='string'].processModel.userName:string /
  [name='string'].processModel.password:string
Note Application pool identities are dynamically added to IIS_WPG group in IIS 7.0 and do not need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.

FAQ for Windows RPCSS Service Isolation Vulnerability - CVE-009-0079

What is the scope of the vulnerability?
This is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could execute arbitrary code with LocalSystem privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability?
The vulnerability is due to the RPCSS service improperly isolating processes that run under the NetworkService or LocalService accounts.

IIS is not affected in the following scenarios:

Default Installations of IIS 5.1, IIS 6.0, and IIS 7.0
ASP.NET configured to run with a trust level lower than Full Trust

All systems running Windows XP Professional Service Pack 2, Windows XP Professional Service Pack 3, and all supported versions and editions of Windows Server 2003 may be at risk if IIS is enabled or SQL Server is installed and configured or deployed in a vulnerable state as described by this bulletin.

What does the update do?
The update addresses the vulnerability by properly isolating processes that run under the NetworkService or LocalService accounts.

Windows Thread Pool ACL Weakness Vulnerability - CVE-2009-0080

An elevation of privilege vulnerability exists due to Windows placing incorrect access control lists (ACLs) on threads in the current ThreadPool. The vulnerability could allow an attacker to run code with elevated privileges. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2009-0080.

Mitigating Factors for Windows Thread Pool ACL Weakness Vulnerability - CVE- 2009-0080

The attacker must be able to run code on the local machine to exploit this vulnerability. An attacker who successfully exploited this vulnerability could gain the same user rights as the LocalSystem service.

Workarounds for Windows Thread Pool ACL Weakness Vulnerability - CVE-2009-0080

IIS 6.0 - Configure a Worker Process Identity (WPI) for an application pool in IIS to use a created account in IIS Manager and disable MSDTC

Perform the following steps:
1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool and select Properties.
2. Click the Identity tab and click Configurable. In the User name and Password boxes, type the user name and password of the account under which you want the worker process to operate.
3. Add the chosen user account to the IIS_WPG group.
Disabling the Distributed Transaction Coordinator will help protect the affected system from attempts to exploit this vulnerability. To disable the Distributed Transaction Coordinator, perform these steps:
1. Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.
2. Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.
3. Double-click Services.
4. Double-click Distributed Transaction Coordinator.
5. In the Startup type list, click Disabled.
6. Click Stop (if started), and then click OK.
You can also stop and disable the MSDTC service by using the following command at the command prompt:
sc stop MSDTC & sc config MSDTC start= disabled

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected. An example is Windows Authentication; see Microsoft Knowledge Base Article 871179. Disabling MSDTC will prevent applications from using distributed transactions. Disabling MSDTC will prevent IIS 5.1 from running in Windows XP Professional Service Pack 2 and Windows XP Professional Service Pack 3, and IIS 6.0 running in IIS 5.0 compatibility mode. Disabling MSDTC will prevent configuration as well as running of COM+ applications.
IIS 7.0 - Specify a WPI for an application pool in IIS Manager
1. In IIS Manager, expand the server node, click Application Pools, right-click the application pool, and then click Advanced Settings…
2. Find the Identity entry, and click the … button to open the Application Pool Identity dialog box.
3. Select the Custom account option and click Set to open the Set Credentials dialog box. Type in the selected Account name and Password in the user name and password text boxes. Retype the Password in the Confirm password text box, then click OK.
Note Application pool identities are dynamically added to IIS_WPG group in IIS7 and don’t need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.
IIS 7.0 - Specify a WPI for an application pool using the Command Line utility APPCMD.exe
1. From an elevated command prompt, change to the %systemroot%\system32\inetsrv directory.
2. Execute the APPCMD.exe command using the following syntax where string is the name of the application pool; userName:string is the user name of the account assigned to the application pool; and password:string is the password for the account.
  appcmd set config /section:applicationPools /
  [name='string'].processModel.identityType:SpecificUser /
  [name='string'].processModel.userName:string /
  [name='string'].processModel.password:string
Note Application pool identities are dynamically added to IIS_WPG group in IIS 7.0 and do not need to be manually added.

Impact of Workaround: Managing the additional user accounts created in this workaround results in increased administrative overhead. Depending on the nature of applications running in this application pool, application functionality may be affected.

FAQ for Windows Thread Pool ACL Weakness Vulnerability - CVE-2009-0080

What is the scope of the vulnerability?
This is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could execute arbitrary code with LocalSystem privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability?
The vulnerability is due to Windows placing incorrect access control lists (ACLs) on threads in the current ThreadPool.

What is the Windows ThreadPool Class?
The Windows ThreadPool class provides a pool of threads that can be used to post work items, process asynchronous I/O, wait on behalf of other threads, and process timers. Many applications create threads that spend a great deal of time in the sleeping state, waiting for an event to occur. Other threads might enter a sleeping state only to be awakened periodically to poll for a change or update status information. Thread pooling enables you to use threads more efficiently by providing your application with a pool of worker threads that are managed by the system. One thread monitors the status of several wait operations queued to the thread pool. When a wait operation completes, a worker thread from the thread pool executes the corresponding callback function. For more information, see the MSDN article, ThreadPool Class.

What is an Access Control List (ACL)?
An access control list (ACL) is a list of security protections that applies to an object. An object can be a file, process, event, or anything else having a security descriptor. An entry in an ACL is an access control entry (ACE). There are two types of access control list, discretionary and system. Each ACE in an ACL identifies access rights allowed, denied, or audited for that trustee. For information, see the MSDN article, Access Control Lists.

IIS is not affected in the following scenarios:

Default Installations of IIS 5.1, IIS 6.0, and IIS 7.0
ASP.NET configured to run with a trust level lower than Full Trust

All systems running all supported editions of Windows Vista and Windows Server 2008 may be at risk if IIS is enabled or SQL Server is installed and configured or deployed in a vulnerable state as described by this bulletin.

What does the update do?
The update addresses the vulnerability correcting the ACLs on thread within the Thread Pool.

Update Information

Detection and Deployment Tools and Guidance

Manage the software and security updates you need to deploy to the servers, desktop, and mobile systems in your organization. For more information see the TechNet Update Management Center. The Microsoft TechNet Security Web site provides additional information about security in Microsoft products.

Security updates are available from Microsoft Update, Windows Update, and Office Update. Security updates are also available from the Microsoft Download Center. You can find them most easily by doing a keyword search for "security update."

Finally, security updates can be downloaded from the Microsoft Update Catalog. The Microsoft Update Catalog provides a searchable catalog of content made available through Windows Update and Microsoft Update, including security updates, drivers and service packs. By searching using the security bulletin number (such as, "MS07-036"), you can add all of the applicable updates to your basket (including different languages for an update), and download to the folder of your choosing. For more information about the Microsoft Update Catalog, see the Microsoft Update Catalog FAQ.

Detection and Deployment Guidance

Microsoft has provided detection and deployment guidance for this month’s security updates. This guidance will also help IT professionals understand how they can use various tools to help deploy the security update, such as Windows Update, Microsoft Update, Office Update, the Microsoft Baseline Security Analyzer (MBSA), the Office Detection Tool, Microsoft Systems Management Server (SMS), and the Extended Security Update Inventory Tool. For more information, see Microsoft Knowledge Base Article 910723.

Microsoft Baseline Security Analyzer

Microsoft Baseline Security Analyzer (MBSA) allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations. For more information about MBSA, visit Microsoft Baseline Security Analyzer.

The following table provides the MBSA detection summary for this security update.

Software	MBSA 2.1
Microsoft Windows 2000 Service Pack 4	Yes
Windows XP Service Pack 2 and Windows XP Service Pack 3	Yes
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	Yes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Yes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	Yes
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	Yes
Windows Vista and Windows Vista Service Pack 1	Yes
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	Yes
Windows Server 2008 for 32-bit Systems	Yes
Windows Server 2008 for x64-based Systems	Yes
Windows Server 2008 for Itanium-based Systems	Yes

For more information about MBSA 2.1, see MBSA 2.1 Frequently Asked Questions.

Windows Server Update Services

By using Windows Server Update Services (WSUS), administrators can deploy the latest critical updates and security updates for Windows 2000 operating systems and later, Office XP and later, Exchange Server 2003, and SQL Server 2000. For more information about how to deploy this security update using Windows Server Update Services, visit the Windows Server Update Services Web site.

Systems Management Server

The following table provides the SMS detection and deployment summary for this security update.

Software	SMS 2.0	SMS 2003 with SUSFP	SMS 2003 with ITMU	Configuration Manager 2007
Microsoft Windows 2000 Service Pack 4	Yes	Yes	Yes	Yes
Windows XP Service Pack 2 and Windows XP Service Pack 3	Yes	Yes	Yes	Yes
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2	No	No	Yes	Yes
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2	Yes	Yes	Yes	Yes
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2	No	No	Yes	Yes
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems	No	No	Yes	Yes
Windows Vista and Windows Vista Service Pack 1	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Server 2008 for 32-bit Systems	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Server 2008 for x64-based Systems	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes
Windows Server 2008 for Itanium-based Systems	No	No	See Note for Windows Vista and Windows Server 2008 below	Yes

For SMS 2.0 and SMS 2003, the SMS SUS Feature Pack (SUSFP), which includes the Security Update Inventory Tool (SUIT), can be used by SMS to detect security updates. See also Downloads for Systems Management Server 2.0.

For SMS 2003, the SMS 2003 Inventory Tool for Microsoft Updates (ITMU) can be used by SMS to detect security updates that are offered by Microsoft Update and that are supported by Windows Server Update Services. For more information about the SMS 2003 ITMU, see SMS 2003 Inventory Tool for Microsoft Updates. SMS 2003 can also use the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications. For more information about the Office Inventory Tool and other scanning tools, see SMS 2003 Software Update Scanning Tools. See also Downloads for Systems Management Server 2003.

System Center Configuration Manager 2007 uses WSUS 3.0 for detection of updates. For more information about Configuration Manager 2007 Software Update Management, visit System Center Configuration Manager 2007.

Note for Windows Vista and Windows Server 2008 Microsoft Systems Management Server 2003 with Service Pack 3 includes support for Windows Vista and Windows Server 2008 manageability.

For more information about SMS, visit the SMS Web site.

For more detailed information, see Microsoft Knowledge Base Article 910723: Summary list of monthly detection and deployment guidance articles.

Update Compatibility Evaluator and Application Compatibility Toolkit

Updates often write to the same files and registry settings required for your applications to run. This can trigger incompatibilities and increase the time it takes to deploy security updates. You can streamline testing and validating Windows updates against installed applications with the Update Compatibility Evaluator components included with Application Compatibility Toolkit 5.0.

The Application Compatibility Toolkit (ACT) contains the necessary tools and documentation to evaluate and mitigate application compatibility issues before deploying Microsoft Windows Vista, a Windows Update, a Microsoft Security Update, or a new version of Windows Internet Explorer in your environment.

Security Update Deployment

Affected Software

For information about the specific security update for your affected software, click the appropriate link:

Windows 2000 (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue may be included in a future update rollup
Deployment
Installing without user intervention	For Microsoft Windows 2000 Service Pack 4:\ Windows2000-KB952004-x86-ENU /quiet
Installing without restarting	For Microsoft Windows 2000 Service Pack 4:\ Windows2000-KB952004-x86-ENU /norestart
Update log file	kb952004.log
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update.
HotPatching	Not applicable
Removal Information	For Microsoft Windows 2000 Service Pack 4:\ Use Add or Remove Programs tool in Control Panel or the Spuninst.exe utility located in the %Windir%$NTUninstallKB952004$\Spuninst folder
File Information	See Microsoft Knowledge Base Article 959454
Registry Key Verification	For Microsoft Windows 2000 Service Pack 4: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB952004

Deployment Information

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

If you have previously installed a hotfix to update one of these files, the installer copies the RTMQFE, SP1QFE, or SP2QFE files to your system. Otherwise, the installer copies the RTMGDR, SP1GDR, or SP2GDR files to your system. Security updates may not contain all variations of these files. For more information about this behavior, see Microsoft Knowledge Base Article 824994.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.

Note You can combine these switches into one command. For backward compatibility, the security update also supports the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying That the Update Has Been Applied

Microsoft Baseline Security Analyzer
To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.
File Version Verification
Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps.
1. Click Start, and then click Search.
2. In the Search Results pane, click All files and folders under Search Companion.
3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the edition of the operating system, or the programs that are installed on your system, some of the files that are listed in the file information table may not be installed.
5. On the Version tab, determine the version of the file that is installed on your system by comparing it to the version that is documented in the appropriate file information table. Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.
Registry Key Verification
You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section.

These registry keys may not contain a complete list of installed files. Also, these registry keys may not be created correctly when an administrator or an OEM integrates or slipstreams this security update into the Windows installation source files.

Windows XP (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	For Windows XP Service Pack 2 and Windows XP Service Pack 3:\ WindowsXP-KB952004-x86-ENU /quiet\ WindowsXP-KB956572-x86-ENU /quiet
For Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2:\ WindowsServer2003.WindowsXP-KB952004-x64-ENU /quiet\ WindowsServer2003.WindowsXP-KB956572-x64-ENU /quiet
Installing without restarting	Windows XP Service Pack 2 and Windows XP Service Pack 3:\ WindowsXP-KB952004-x86-ENU /norestart\ WindowsXP-KB956572-x86-ENU /norestart
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2:\ WindowsServer2003.WindowsXP-KB952004-x64-ENU /norestart\ WindowsServer2003.WindowsXP-KB956572-x64-ENU /norestart
Update log file	KB952004.log\ KB956572.log
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update.
HotPatching	Not applicable
Removal Information	Use Add or Remove Programs tool in Control Panel or the Spuninst.exe utility located in the %Windir%$NTUninstallKB952004$\Spuninst and %Windir%$NTUninstallKB956572$\Spuninst folders
File Information	See Microsoft Knowledge Base Article 959454
Registry Key Verification	For all supported 32-bit editions of Windows XP:\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP4\KB952004\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP4\KB956572
For all supported x64-based editions of Windows XP:\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP3\KB952004\Filelist\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP3\KB956572\Filelist

Note For supported versions of Windows XP Professional x64 Edition, this security update is the same as supported versions of the Windows Server 2003 x64 Edition security update.

Deployment Information

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/integrate:path	Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.

Removing the Update

This security update supports the following setup switches.

Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying That the Update Has Been Applied

Microsoft Baseline Security Analyzer
To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.
File Version Verification
Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps.
1. Click Start, and then click Search.
2. In the Search Results pane, click All files and folders under Search Companion.
3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the edition of the operating system, or the programs that are installed on your system, some of the files that are listed in the file information table may not be installed.
5. On the Version tab, determine the version of the file that is installed on your system by comparing it to the version that is documented in the appropriate file information table. Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.
Registry Key Verification
You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section.

These registry keys may not contain a complete list of installed files. Also, these registry keys may not be created correctly when an administrator or an OEM integrates or slipstreams this security update into the Windows installation source files.

Windows Server 2003 (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	For all supported 32-bit editions of Windows Server 2003:\ WindowsServer2003-KB952004-x86-ENU /quiet\ WindowsServer2003-KB956572-x86-ENU /quiet
For all supported x64-based editions of Windows Server 2003:\ WindowsServer2003.WindowsXP-KB952004-x64-ENU /quiet\ WindowsServer2003.WindowsXP-KB956572-x64-ENU /quiet
For all supported Itanium-based editions of Windows Server 2003:\ WindowsServer2003-KB952004-ia64-ENU /quiet\ WindowsServer2003-KB956572-ia64-ENU /quiet
Installing without restarting	For all supported 32-bit editions of Windows Server 2003:\ WindowsServer2003-KB952004-x86-ENU /norestart\ WindowsServer2003-KB956572-x86-ENU /norestart
For all supported x64-based editions of Windows Server 2003:\ WindowsServer2003.WindowsXP-KB952004-x64-ENU /norestart\ WindowsServer2003.WindowsXP-KB956572-x64-ENU /norestart
For all supported Itanium-based editions of Windows Server 2003:\ WindowsServer2003-KB952004-ia64-ENU /norestart\ WindowsServer2003-KB956572-ia64-ENU /norestart
Update log file	KB952004.log\ KB956572.log
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update.
HotPatching	This security update does not support HotPatching. For more information about HotPatching, see Microsoft Knowledge Base Article 897341.
Removal Information	Use Add or Remove Programs tool in Control Panel or the Spuninst.exe utility located in the %Windir%$NTUninstallKB952004$\Spuninst and %Windir%$NTUninstallKB956572$\Spuninst folders
File Information	See Microsoft Knowledge Base Article 959454
Registry Key Verification	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP3\KB952004\Filelist\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP3\KB956572\Filelist

Deployment Information

Installing the Update

When you install this security update, the installer checks to see if one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the installer, visit the Microsoft TechNet Web site.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/overwriteoem	Overwrites OEM files without prompting.
/nobackup	Does not back up files needed for uninstall.
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.
/integrate:path	Integrates the update into the Windows source files. These files are located at the path that is specified in the switch.
/extract[:path]	Extracts files without starting the Setup program.
/ER	Enables extended error reporting.
/verbose	Enables verbose logging. During installation, creates %Windir%\CabBuild.log. This log details the files that are copied. Using this switch may cause the installation to proceed more slowly.

Note You can combine these switches into one command. For backward compatibility, the security update also supports many of the setup switches that the earlier version of the Setup program uses. For more information about the supported installation switches, see Microsoft Knowledge Base Article 262841.

Removing the Update

This security update supports the following setup switches.

Switch	Description
/help	Displays the command-line options.
Setup Modes
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.
/quiet	Quiet mode. This is the same as unattended mode, but no status or error messages are displayed.
Restart Options
/norestart	Does not restart when installation has completed.
/forcerestart	Restarts the computer after installation and force other applications to close at shutdown without saving open files first.
/warnrestart[:x]	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (The default setting is 30 seconds.) Intended for use with the /quiet switch or the /passive switch.
/promptrestart	Displays a dialog box prompting the local user to allow a restart.
Special Options
/forceappsclose	Forces other programs to close when the computer shuts down.
/log:path	Allows the redirection of installation log files.

Verifying that the Update Has Been Applied

Microsoft Baseline Security Analyzer
To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.
File Version Verification
Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps.
1. Click Start, and then click Search.
2. In the Search Results pane, click All files and folders under Search Companion.
3. In the All or part of the file name box, type a file name from the appropriate file information table, and then click Search.
4. In the list of files, right-click a file name from the appropriate file information table, and then click Properties. Note Depending on the edition of the operating system, or the programs that are installed on your system, some of the files that are listed in the file information table may not be installed.
5. On the Version tab, determine the version of the file that is installed on your system by comparing it to the version that is documented in the appropriate file information table. Note Attributes other than the file version may change during installation. Comparing other file attributes to the information in the file information table is not a supported method of verifying that the update has been applied. Also, in certain cases, files may be renamed during installation. If the file or version information is not present, use one of the other available methods to verify update installation.
Registry Key Verification
You may also be able to verify the files that this security update has installed by reviewing the registry keys listed in the Reference Table in this section.

These registry keys may not contain a complete list of installed files. Also, these registry keys may not be created correctly when an administrator or an OEM integrates or slipstreams this security update into the Windows installation source files.

Windows Vista (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	For all supported 32-bit editions of Windows Vista:\ Windows6.0-KB952004-x86 /quiet\ Windows6.0-KB956572-x86 /quiet\ \ For all supported x64-based editions of Windows Vista:\ Windows6.0-KB952004-x64 /quiet\ Windows6.0-KB956572-x64 /quiet
Installing without restarting	For all supported 32-bit editions of Windows Vista:\ Windows6.0-KB952004-x86 /quiet /norestart\ Windows6.0-KB956572-x86 /quiet /norestart\ \ For all supported x64-based editions of Windows Vista:\ Windows6.0-KB952004-x64 /quiet /norestart\ Windows6.0-KB956572-x64 /quiet /norestart
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update.
HotPatching	Not applicable.
Removal Information	WUSA.exe does not support uninstall of updates. To uninstall an update installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates and select from the list of updates.
File Information	See Microsoft Knowledge Base Article 959454
Registry Key Verification	Note A registry key does not exist to validate the presence of this update.

Deployment Information

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

Microsoft Baseline Security Analyzer
To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.
File Version Verification
Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps.
1. Click Start and then enter an update file name in Start Search.
2. When the file appears under Programs, right-click on the file name and click Properties.
3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article.
4. You may also click on the Details tab and compare information, such as file version and date modified, with the file information tables provided in the bulletin KB article.
5. Finally, you may also click on the Previous Versions tab and compare file information for the previous version of the file with the file information for the new, or updated, version of the file.

Windows Server 2008 (all editions)

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Inclusion in Future Service Packs	The update for this issue will be included in a future service pack or update rollup
Deployment
Installing without user intervention	For all supported 32-bit editions of Windows Server 2008:\ Windows6.0-KB952004-x86 /quiet\ Windows6.0-KB956572-x86 /quiet\ \ For all supported x64-based editions of Windows Server 2008:\ Windows6.0-KB952004-x64 /quiet\ Windows6.0-KB956572-x64 /quiet\ \ For all supported Itanium-based editions of Windows Server 2008:\ Windows6.0-KB952004-ia64 /quiet\ Windows6.0-KB956572-ia64 /quiet
Installing without restarting	For all supported 32-bit editions of Windows Server 2008:\ Windows6.0-KB952004-x86 /quiet /norestart\ Windows6.0-KB956572-x86 /quiet /norestart\ \ For all supported x64-based editions of Windows Server 2008:\ Windows6.0-KB952004-x64 /quiet /norestart\ Windows6.0-KB956572-x64 /quiet /norestart\ \ For all supported Itanium-based editions of Windows Server 2008:\ Windows6.0-KB952004-ia64 /quiet /norestart\ Windows6.0-KB956572-ia64 /quiet /norestart
Further information	See the subsection, Detection and Deployment Tools and Guidance
Restart Requirement
Restart required?	Yes, you must restart your system after you apply this security update.
HotPatching	Not applicable.
Removal Information	WUSA.exe does not support uninstall of updates. To uninstall an update installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates and select from the list of updates.
File Information	See Microsoft Knowledge Base Article 959454
Registry Key Verification	Note A registry key does not exist to validate the presence of this update.

Deployment Information

Installing the Update

When you install this security update, the installer checks whether one or more of the files that are being updated on your system have previously been updated by a Microsoft hotfix.

For more information about the terminology that appears in this bulletin, such as hotfix, see Microsoft Knowledge Base Article 824684.

This security update supports the following setup switches.

Switch	Description
/?, /h, /help	Displays help on supported switches.
/quiet	Suppresses the display of status or error messages.
/norestart	When combined with /quiet, the system will not be restarted after installation even if a restart is required to complete installation.

Note For more information about the wusa.exe installer, see Microsoft Knowledge Base Article 934307.

Verifying That the Update Has Been Applied

Microsoft Baseline Security Analyzer
To verify that a security update has been applied to an affected system, you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. See the section, Detection and Deployment Tools and Guidance, earlier in this bulletin for more information.
File Version Verification
Because there are several editions of Microsoft Windows, the following steps may be different on your system. If they are, see your product documentation to complete these steps.
1. Click Start and then enter an update file name in Start Search.
2. When the file appears under Programs, right-click on the file name and click Properties.
3. Under the General tab, compare the file size with the file information tables provided in the bulletin KB article.
4. You may also click on the Details tab and compare information, such as file version and date modified, with the file information tables provided in the bulletin KB article.
5. Finally, you may also click on the Previous Versions tab and compare file information for the previous version of the file with the file information for the new, or updated, version of the file.

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

Cesar Cerrudo of Argeniss for reporting the Windows MSDTC Service Isolation Vulnerability (CVE-2008-1436), Windows WMI Service Isolation Vulnerability (CVE-2009-0078), Windows RPCSS Service Isolation Vulnerability (CVE-2009-0079), and Windows Thread Pool ACL Weakness Vulnerability (CVE-2009-0080)

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections Web sites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Support

Customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. For more information about available support options, see Microsoft Help and Support.
International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

V1.0 (April 14, 2009): Bulletin published.
V1.1 (April 15, 2009): Corrected the FAQ for the Windows Thread Pool ACL Weakness Vulnerability (CVE-2009-0080) to remove an erroneous "What does the update do" entry. This is an informational change only.
V1.2 (April 22, 2009): Added entry to the section, Frequently Asked Questions (FAQ) Related to This Security Update, to communicate that the Known issues with this security update section referenced in the associated Microsoft Knowledge Base Article 959454 has been updated. This is an informational change only.
V2.0 (April 29, 2009): Added an entry to the section, Frequently Asked Questions (FAQ) Related to This Security Update to communicate the rerelease of the Norwegian-language update for Microsoft Windows 2000 Service Pack 4 (KB952004). Customers who require the Norwegian-language update need to download and install the rereleased update. No other updates or locales are affected by this rerelease.

Built at 2014-04-18T13:49:36Z-07:00

Share via

Microsoft Security Bulletin MS09-012 - Important

Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)

General Information

Executive Summary

Affected and Non-Affected Software

Frequently Asked Questions (FAQ) Related to This Security Update

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

Mitigating Factors for Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

Workarounds for Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

FAQ for Windows MSDTC Service Isolation Vulnerability - CVE-2008-1436

Windows WMI Service Isolation Vulnerability - CVE-2009-0078

Mitigating Factors for Windows WMI Service Isolation Vulnerability - CVE-2009-0078

Workarounds for Windows WMI Service Isolation Vulnerability - CVE-2009-0078

FAQ for Windows WMI Service Isolation Vulnerability - CVE-2009-0078

Windows RPCSS Service Isolation Vulnerability - CVE-2009-0079

Mitigating Factors for Windows RPCSS Service Isolation Vulnerability - CVE-2009-0079

Workarounds for Windows RPCSS Service Isolation Vulnerability - CVE-2009-0079

FAQ for Windows RPCSS Service Isolation Vulnerability - CVE-009-0079

Windows Thread Pool ACL Weakness Vulnerability - CVE-2009-0080

Mitigating Factors for Windows Thread Pool ACL Weakness Vulnerability - CVE- 2009-0080

Workarounds for Windows Thread Pool ACL Weakness Vulnerability - CVE-2009-0080

FAQ for Windows Thread Pool ACL Weakness Vulnerability - CVE-2009-0080

Update Information

Detection and Deployment Tools and Guidance

Security Update Deployment

Windows 2000 (all editions)

Deployment Information

Windows XP (all editions)

Deployment Information

Windows Server 2003 (all editions)

Deployment Information

Windows Vista (all editions)

Deployment Information

Windows Server 2008 (all editions)

Deployment Information

Other Information

Acknowledgments

Microsoft Active Protections Program (MAPP)

Support

Disclaimer

Revisions

Additional resources