14 DAY TRIAL // Windows Live Messenger and older versions of the Microsoft instant messaging client from the MSN Messenger lineup will permit an attacker to completely take over your system. A range of the Redmond company's IM client versions are affected by a Video Conversation Buffer Overflow vulnerability, but not 32-bit and 64-bit Windows Vista users running Windows Live Messenger 8.1, or the beta for Windows Live Messenger 8.5. Additionally, Microsoft also informed that MSN Messenger 7.0.0820 is in no way impacted by the security flaw.
"This is a remote buffer overflow vulnerability affecting MSN Messenger and Windows Live Messenger. This issue occurs during a video conversation because the application doesn't properly check the 'chunk_index' of an incoming packet, resulting in a heap-based overflow. A public exploit for the Chinese version of Windows 2000 is available," revealed Ben Greenbaum / Sr. Security Response Researcher and manager of the DeepSight threat analysis team.
The MSN/Windows Live Messenger Video Conversation Buffer Overflow vulnerability was labeled with a maximum severity rating of Important, but a successful exploit will indeed lead to remote code execution of arbitrary code. Users of MSN Messenger 6.2, MSN Messenger 7.0, MSN Messenger 7.5 and Windows Live Messenger 8.0 should upgrade to MSN Messenger 7.0.0820 and to Windows Live Messenger 8.1, respectively. It is important to note that this security flaw is already exploited in the wild, and that it's not a privately reported vulnerability, as proof of concept is available. Still, if you are running the latest Windows Live Messenger, namely version 8.1, you are not at any risk.
"This important security update resolves a publicly disclosed vulnerability in MSN Messenger and Windows Live Messenger. The vulnerability could allow remote code execution when a user accepts a webcam or video chat invitation from an attacker. An attacker who successfully exploited this vulnerability could take complete control of the affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights," Microsoft revealed.
Microsoft handled the MSN/Windows Live Messenger vulnerability as a part of the security bulleting releases of its monthly patch cycle. You will be able to access all the security updates via the links included below for vulnerabilities in Windows Services for UNIX, Crystal Reports for Visual Studio and in Microsoft Agent.
- Microsoft Security Bulletin MS07-051 - Critical Vulnerability in Microsoft Agent Could Allow Remote Code Execution (938827) - Microsoft Security Bulletin MS07-052 - Important Vulnerability in Crystal Reports for Visual Studio Could Allow Remote Code Execution (941522) - Microsoft Security Bulletin MS07-053 - Important Vulnerability in Windows Services for UNIX Could Allow Elevation of Privilege (939778) - Microsoft Security Bulletin MS07-054 - Important Vulnerability in MSN Messenger and Windows Live Messenger Could Allow Remote Code Execution (942099)