MS10-049: A remote Code Execution vulnerability in SChannel, CVE-2010-2566

In MS10-049, we are also addressing a second vulnerability, CVE-2010-2566. This is a vulnerability in schannel.dll which can potentially lead to Remote Code Execution. The vulnerability is present only in Windows XP and Windows Server 2003, and does not affect Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2.

This vulnerability is present in the code that validates client certificate requests sent by the server. An attacker could set up a malicious TLS or SSL-enabled server, and convince a user to connect to it using a Windows client application.

A malicious server could then respond with a specifically crafted message in a way that induces heap corruption on the client, leading to a crash of the Local Security Authority Subsystem Service (LSASS). Theoretically, this is an exploitable condition, and the attacker could then arbitrary code as LocalSystem.

A detailed investigation by our team, however, has indicated that the attacker has very little control over what is written to the heap. This vulnerability has an Exploitability Index rating of 2, which indicates we believe it’s unlikely that reliable exploit code will be published within 30 days.

We do recommend customers to install this update, especially because it is difficult to build on-the-wire mitigation against this issue. In the TLS handshake protocol, the client certificate is usually requested inside the existing encrypted TLS channel. This makes it difficult for firewalls and intrusion prevention systems to successfully detect and block an attack.

Acknowledgements

Thanks to Mark Wodrich and Bruce Dang from the MSRC Engineering team for their contribution to this blog post.

Cheers,
-Maarten Van Horenbeeck, MSRC Program Manager