Microsoft XML Parser MSXML and XML Core Services Unsupported

Overview

This page details vulnerabilities associated with unsupported versions of Microsoft XML Parser (MSXML) and XML Core Services. MSXML and XML Core Services provide standards-based implementations of XML technologies including XML 1.0, XML Schema (XSD), XSLT 1.0, and others. Unsupported versions no longer receive security updates or technical support, making them susceptible to various security threats.

• Severity: Medium to High

Impact

The use of unsupported MSXML and XML Core Services can lead to multiple security vulnerabilities, exposing systems to:

• Data Breaches: Exploiting vulnerabilities in XML processing can allow unauthorized access to confidential data.
• Denial of Service Attacks: Flaws in XML parsing can be exploited to cause service disruptions.
• Remote Code Execution: Older, unsupported versions may contain unpatched vulnerabilities that could allow attackers to execute arbitrary code.

Cause

The core issue arises from the continued use of outdated software versions that no longer receive security patches or updates. As new vulnerabilities are discovered and not fixed in these versions, the risk of exploitation increases.

Solution

Upgrading to Supported Versions:

To mitigate the risks associated with outdated MSXML and XML Core Services, upgrading to the latest supported versions is essential.

• Identify Current Versions in PowerShell:

  Get-WmiObject -Query "SELECT * FROM Win32_Product WHERE Name LIKE '%MSXML%'"

• Download and install the latest supported MSXML version (e.g., MSXML 6.0 Service Pack 1).

System Hardening and Monitoring:

• Configure XML Security: Apply security best practices for XML processing, such as disabling external entity processing and limiting XML expansion to prevent Billion Laughs attacks.
• Regular System Audits: Conduct regular audits to ensure unsupported software is identified and updated.
• Patch Management: Implement a robust patch management policy to ensure all software, especially critical components like XML processors, are kept up-to-date.

Examples

XML Configuration for Security in .NET:

<configuration>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <probing privatePath="lib;bin"/>
    </assemblyBinding>
  </runtime>
</configuration>

References

• Microsoft Support Lifecycle

Additional Resources

• Microsoft Security Update Guide