Microsoft Malware Protection Engine File Parsing Denial of Service - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

Microsoft Malware Protection Engine File Parsing Denial of Service

Secunia Advisory:	SA30172
Release Date:	2008-05-13
Last Update:	2008-05-14

Critical:	Moderately critical
Impact:	DoS
Where:	From remote
Solution Status:	Vendor Patch

Software:	Microsoft Antigen 9.x Microsoft Diagnostics and Recovery Toolset 6.x Microsoft Forefront Client Security 1.x Microsoft Forefront Security for Exchange Server Microsoft Forefront Security for SharePoint Microsoft Windows Defender Microsoft Windows Live OneCare

CVE reference:	CVE-2008-1437 (Secunia mirror) CVE-2008-1438 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Two vulnerabilities have been reported in various Microsoft products, which can be exploited by malicious people to cause a DoS (Denial of Service). 1) An unspecified error in the Malware Protection Engine when parsing PE files can be exploited to cause the engine to stop responding and restart when scanning a specially crafted PE file. 2) An input validation error in the Malware Protection Engine when parsing PE files can be exploited to exhaust available disk space when scanning a specially crafted PE file containing an overly large "size of header" value. Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector. Solution: Apply the latest Microsoft Malware Protection Engine update. Provided and/or discovered by: The vendor credits Sowhat, Nevis Labs. Changelog: 2008-05-14: Updated "Description" section based on additional information from Sowhat. Added additional link in "Original Advisory" section. Original Advisory: MS08-029 (KB952044): http://www.microsoft.com/technet/security/Bulletin/MS08-029.mspx Sowhat: http://secway.org/advisory/AD20080514.txt



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

1 Related Secunia Security Advisories

1. Microsoft Malware Protection Engine PDF File Parsing Vulnerability

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	OpenBSD BIND Query Port DNS Cache Poisoning

2.	Red Hat update for kernel

3.	Linux Kernel LDT Buffer Size Handling Vulnerability

4.	Drupal Session Fixation Vulnerability

5.	IPCop update for perl

6.	Debian update for clamav

7.	Ubuntu update for php

8.	Debian update for xulrunner

9.	Apple Safari Cross-Domain Cookie Injection Vulnerability

10.	dnsmasq Denial of Service and DNS Cache Poisoning