MSXML Integer Truncation Vulnerability

Successful exploitation allows remote code execution in the context of the logged-on user. If the victim has administrative privileges, an attacker may gain complete control of the affected system, including installing programs, modifying data, creating accounts, and taking further actions consistent with that user context. On less-privileged accounts, impact is constrained by those permissions. Affected client platforms were rated Critical by Microsoft, while affected Windows Server platforms were generally rated Moderate due to reduced exposure and default mitigations such as Internet Explorer Enhanced Security Configuration.

If immediate patching is not possible, Microsoft documented several mitigations and workarounds: enable or retain Internet Explorer Enhanced Security Configuration on supported Windows Server systems; set the Internet and Local intranet zones to High to block ActiveX controls and active scripting; set the kill bit for the MSXML 5.0 ActiveX control in Internet Explorer via registry changes; and restrict access to msxml3.dll and msxml6.dll. These measures can reduce exploitability but may break XML-dependent websites or application functionality, so they should be treated as temporary risk-reduction steps rather than substitutes for patching.

Apply the security updates provided in Microsoft Security Bulletin MS13-002. Microsoft states the fix modifies how Microsoft XML Core Services parses XML content. Relevant update packages vary by product and platform and include KB2757638, KB2758694, KB2758696, KB2760574, KB2687499, and KB2687497, depending on the installed MSXML version and associated software. Because multiple MSXML versions can coexist on a system, more than one update may be required. For SharePoint Server 2007 and Groove Server 2007, Microsoft rereleased KB2687497; systems that had already installed the earlier MS12-043 version still needed to install the rereleased package.