MS09-013: Vulnerabilities in Windows HTTP services could allow remote code execution

View products that this article applies to.

INTRODUCTION

Microsoft has released security bulletin MS09-013. To view the complete security bulletin, visit one of the following Microsoft Web sites:

Home users:
http://www.microsoft.com/protect/computer/updates/bulletins/200904.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200904.mspx)
Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
IT professionals:
http://www.microsoft.com/technet/security/bulletin/MS09-013.mspx (http://www.microsoft.com/technet/security/bulletin/MS09-013.mspx)

Back to the top

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

http://support.microsoft.com/common/international.aspx?rdpath=4 (http://support.microsoft.com/common/international.aspx?rdpath=4)

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

http://support.microsoft.com/oas/default.aspx?&prid=7552 (http://support.microsoft.com/oas/default.aspx?&prid=7552)

For enterprise customers, support for security updates is available through your usual support contacts.

Back to the top

MORE INFORMATION

Known issues with this security update

In certain scenarios, after you install this security update, the Logon Agent for certain versions of Websense Web Filter or Websense Web Security may no longer work correctly to identify users. WebSense has made an update available that resolves this issue. We recommend that customers that are affected by this issue contact their software vendor for support and an update. The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
When a client tries to connect to an HTTP server that is running on a local system by using NTLM authentication and IPv6 addresses, the client receives the following error message:
Connection Denied
This problem occurs because of a known issue in the underlying NTLM provider. The provider does not recognize IPv6 addresses in the local context. To work around the issue, use one of the following methods.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

For more information about this registry configuration, click the following article number to view the article in the Microsoft Knowledge Base:
896861 (http://support.microsoft.com/kb/896861/ ) You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6
Method 1: Use a single host name for all the variants of the IPv6 addresses
To do this, follow these steps:
1. In Notepad, open the following file:
  %systemroot%\System32\drivers\etc\hosts
2. Type the following entry for each IPv6 address to be used:
  <IPv6Address> <hostname>
3. Save and then close the host file.
4. In the registry, specify each host name that you typed in step 2. To do this, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
  3. Right-click MSV1_0, point to New, and then click Multi-String Value.
  4. Type BackConnectionHostNames, and then press ENTER.
  5. Right-click BackConnectionHostNames, and then click Modify.
  6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
  7. Exit Registry Editor, and then restart the computer.
Method 2: Use different host name aliases for all the different variants of the IPv6 addresses
To do this, follow these steps:
1. In Notepad, open the following file:
  %systemroot%\System32\drivers\etc\hosts
2. Type the following entries for each IPv6 address to be used:
  IPv6Address1 hostnameAlias1
  IPv6Address2 hostnameAlias2
3. Save and then close the host file.
4. In the registry, specify each host name that you typed in step 2. To do this, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
  3. Right-click MSV1_0, point to New, and then click Multi-String Value.
  4. Type BackConnectionHostNames, and then press ENTER.
  5. Right-click BackConnectionHostNames, and then click Modify.
  6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
  7. Exit Registry Editor, and then restart the computer.
5. Use the host name that is used in step 2 to open the HTTP connection.

Back to the top

FILE INFORMATION

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Back to the top