MS09-042: Vulnerability in Telnet could allow remote code execution

Additional information about this security update

• What does this security bulletin address?
  This security update addresses reflection protection in the Telnet protocol. For more information about Reflection Protection, please review the following security bulletin:
  
  http://www.microsoft.com/technet/security/bulletin/MS09-042.mspx
• What is Extended Protection?
  This security update contains a defense in-depth fix to allow for the Telnet client and server to opt in to extended protection. By default, this functionality is disabled. Please review this security update and the following security advisory closely which describe Extended Protection in more detail to make sure that you know the affect of these changes:
  973811 Microsoft Security Advisory: Extended protection for authentication
  
  
• How do I enable Extended Protection on my computer?
  Before you enable Extended Protection, make sure that the following update is installed on both the client and server computers:
  
  
  968389 Extended Protection for Authentication
  
  
  To be able to enable Extended Protection for Telnet, make sure that the updates in Security Advisory 968389 and in this article are installed on both the client and server computers.
  
  
  Note The client-side setting that enables Extended Protection is a system-wide setting. When this setting is enabled, Extended Protection is enabled for all components on the client computer.
  
  
  On a server, Extended Protection has to be enabled for each component individually. Make sure that all client components for a particular server are updated for Extended Protection before you enable it on server or else authentication failures may occur.After both security updates are installed, you will then have to enable Extended Protection on both client and server computers.
  
  
  To enable Extended Protection on your computer, the following changes are required.
  
  
  Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
  322756 How to back up and restore the registry in Windows
  • If the computer is a Telnet client:
    
    1. Verify that the registry values SuppressExtendedProtection and LmCompatibilityLevel are located in the following registry subkey:
       
       
       HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\
    2. If the registry values are not present, start Registry Editor, and then follow these steps:
       1. Locate and then click the following key in the registry:
          
          HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\
       2. On the Edit menu, point to New, and then click DWORD Value.
       3. Type SuppressExtendedProtection, and then press ENTER.
          
       4. On the Edit menu, click Modify.
          
       5. Type 0, and then click OK.
          
       6. On the Edit menu, point to New, and then click DWORD Value.
       7. Type LmCompatibilityLevel, and then press ENTER.
          
       8. On the Edit menu, click Modify.
          
          
          Note This step changes NTLM authentication requirements. Please review the following article in the Microsoft Knowledge Base to make sure you are familiar with this behavior.
          239869 How to enable NTLM 2 authentication
          
          
       9. Type 3, and then click OK.
          
       10. Exit Registry Editor.
  • On a Telnet server:
    Before you make the following changes, refer to the following MSDN article before setting any hardening modes:
    
    http://msdn.microsoft.com/en-us/library/dd767318.aspx
    1. Verify that the registry value ExtendedProtection is located in the following registry subkey:
       
       
       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\
    2. If the registry value is not present, start Registry Editor and then follow these steps:
       1. Locate and then click the following key in the registry:
          
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\
       2. On the Edit menu, point to New, and then click DWORD Value.
       3. Type ExtendedProtection, and then press ENTER.
          
       4. On the Edit menu, click Modify.
          
       5. Set the registry value by using one of the following values, based on your Telnet requirements, and then click OK:
          
          • Legacy: Allow all kinds of clients. Set ExtendedProtection to 0.
          • Partial: (Legacy + EP) Allow clients that do not to send a service principal name (SPN), or allow clients that send the correct SPN. Set ExtendedProtection to 1.
            
          • Fully Hardened: (Only EP) Allow clients that send only the correct SPN. Set ExtendedProtection to 2.
       6. Exit Registry Editor.
• When you install this package
  The following registry key and value are created on computers that are running Windows XP or on servers that are running Windows Server 2003 only:
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\ExtendedProtection
  
  
  The default value for ExtendedProtection is set to 0. On Windows Vista, you have to manually create this key and provide the appropriate value as per the hardening mode that is selected. To add the registry value, follow the steps that are listed earlier in this article under "How do I enable Extended Protection on my computer?"
• Default allowed SPNs on a Telnet server:
  • By default, the Telnet server will allow the following list of names and IPs:
    • "localhost" as a string in English.
      
    • All the variants of IP (IPv4 & IPv6) of your own server or computer.
      
    • 127.0.0.1 & ::1
      
    • Hostname in NetBIOS format
      
    • Hostname in FQDN format.
      
  • If the administrator decides to allow other SPNs, he can add more names as follows. The name will not be converted from NetBIOS to FQDN or from FQDN to NetBIOS:
    • If the AllowedSPN registry value is not present, start Registry Editor and then follow these steps:
      1. Locate and then click the following key in the registry:
         
         HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\
      2. On the Edit menu, point to New, and then click Multi-String Value.
      3. Type AllowedSPN, and then press ENTER.
         
      4. On the Edit menu, click Modify.
         
      5. Add the aliases that you want to be allowed as SPNs. The following entry is a valid SPN for Telnet:
         
         telnet/machineName
         
      6. Click OK, and then exit Registry Editor.

Known issues with this security update

• On computers that are running Windows XP, or on servers that are running Windows Server 2003, you may experience the following localhost failure on IPv6 addresses and computer aliases:
  
  
  
  Microsoft Telnet clients will not connect to local IPv6 addresses and all localhost aliases except for "localhost" and "hostname."
  
  
  
  To resolve this issue, follow the appropriate steps:
  
  • For an IPv6 address failure, follow the steps in the "Known issues with this security update" section of the following Knowledge Base article:
    
    960803 MS09-013: Vulnerabilities in Windows HTTP services could allow remote code execution
    
    
  • For a localhost alias failure, use Method 1 in the "Workaround" section of the following Knowledge Base article:
    
    896861 You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6
    
    
• When you try create a Telnet session to any IP address in the address range of 127.*.*.*, the Telnet session will fail except for the IP address 127.0.0.1.
  
  
  
  This issue will occur on Windows 2000, on Windows XP, and on Windows Server 2003.
  
• By default, Reflection Protection is not available on Windows 2000.
• Relay (Extended) Protection is available only on the following operating systems:
  
  • All versions of Windows Vista
  • Windows Server 2003 Service Pack 2 QFE and Windows Server 2003 Service Pack 2 GDR
  • Windows XP Service Pack 2 QFE, Windows XP Service Pack 2 GDR, Windows XP Service Pack 3 QFE, and Windows XP Service Pack 3 GDR
• You cannot Telnet on a cluster name and FQDN. You will have to add the cluster name and FQDN to the AllowedSPN registry value. See the "When you install this package" section for information about how to do this.
  
• You cannot Telnet to a server by using an alias name. You will have to add the alias name to the AllowedSPN registry value. See the "When you install this package" section for information about how to do this.
  
• This update will not be offered to Windows 2000 customers who have Services for Unix installed on their systems.