Check Point Advisories

Protection against Microsoft Windows HTTP Services Certificate Name Mismatch Remote Code Execution Vulnerability (MS09-013)

Check Point Reference:	SBP-2009-10
Date Published:	14 Apr 2009
Severity:	High
Last Updated:	Friday 17 April, 2009
Source:	Microsoft Security Bulletin MS09-013
Industry Reference:	CVE-2009-0089
Protection Provided by:
Who is Vulnerable?	Microsoft Windows 2000 SP4 Windows XP SP2 Windows XP SP3 Windows XP Professional x64 Edition Windows XP Professional x64 Edition SP2 Windows Server 2003 SP1 Windows Server 2003 SP2 Windows Server 2003 x64 Edition Windows Server 2003 x64 Edition SP2 Windows Server 2003 with SP1 (Itanium) Windows Server 2003 with SP2 (Itanium) Windows Vista Windows Vista SP1 Windows Vista x64 Edition Windows Vista x64 Edition SP1 Windows Server 2008 for 32-bit Systems Windows Server 2008 for x64-based Systems
Vulnerability Description	A spoofing vulnerability has been reported in Microsoft Windows HTTP Services. Windows HTTP Services (WinHTTP) provides developers with an HTTP client application programming interface (API) to send requests through the HTTP protocol to other HTTP servers. A remote attacker may exploit this issue to impersonate a secure (HTTPS) web site.
Update/Patch Avaliable	Apply patches: Microsoft Security Bulletin MS09-013
Vulnerability Details	The vulnerability is due to the WinHTTP incomplete validation of the distinguished name in a digital certificate. An attacker would need to combine this vulnerability with DNS spoofing to allow him to successfully spoof the digital certificate of a web site for any application that uses the Windows HTTP Services.