Some vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious people to conduct spoofing attacks or compromise a user's system.

1) An integer underflow error in Windows HTTP Services can be exploited to execute arbitrary code via a specially crafted parameter returned by a malicious web server.

2) An error in Windows HTTP Services while validating the distinguished name of a certificate can be exploited to spoof a valid certificate.

Successful exploitation requires the ability to perform DNS spoofing attacks.

3) An error in Windows HTTP Services can be exploited to reflect NTLM credentials and execute arbitrary code by tricking a user into connecting to a malicious web server.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) The vendor credits Greg MacManus of iSIGHT Partners Labs.
2) The vendor credits Wan-Teh Chang and Cem Paya of Google.
3) Reported by the vendor.

Original Advisory
MS09-013 (KB960803):
http://www.microsoft.com/technet/security/bulletin/ms09-013.mspx

Deep Links
Links available in Customer Area