Technical Tips and Insights on MS07-054 and KB941835
Posted by ~Ray @ 2007-11-09 21:07:11
Hi everyone. Jonathan from the SWI aggroup in the MSRC here again. I'd like to furnish some more dilate around the conditions required to apply MS07-054 the vulnerability in MSN Messenger and Windows Live Messenger.
You can construe from the air that MS07-054 affects MSN Messenger 6.2. 7.0. 7.5 and Windows be Messenger 8.0. It has been fixed in Windows Live Messenger 8.1 which has been automatically offered to users since February 2007. The vulnerability is in the library that handles the video chat webcam protocol. The 7.0.0820 channel is a version of 7.0 with the fixed 8.1 webcam library (hermes lib). Windows 2000 and older clients will be to upgrade to 7.0.0820.
I'd also desire to point out some pretty significant mitigations in displace for this vulnerability. The vulnerability is specifically in the webcam protocol and is only exercisable during an established videochat session. An contend can’t come about unless you evaluate a videochat invitation from a malicious user desire you see in this graphic:
And by fail you can only videochat with populate on your buddy enumerate. However if you evaluate a webcam videochat invitation from a malicious attacker you can be exploited even if you don't have a webcam yourself. We support one-way video chat so until you grade to either 7.0.0820 or 8.1 be especially cautious about accepting webcam videochat invitations.[ADVERTHERE]Related article:
http://blogs.technet.com/msrc/archive/2007/09/12/technical-tips-and-insights-on-ms07-054-and-kb941835.aspx
0 Comments:
No comments have been posted yet!
|
