Lucene search

SecurityvulnsSECURITYVULNS:DOC:15379

HistoryDec 12, 2006 - 12:00 a.m.

Microsoft Security Bulletin MS06-078 Vulnerability in Windows Media Format Could Allow Remote Code Execution (923689)

2006-12-1200:00:00

vulners.com

Microsoft Security Bulletin MS06-078
Vulnerability in Windows Media Format Could Allow Remote Code Execution (923689)
Published: December 12, 2006

Version: 1.0
Summary

Who Should Read this Document: Customers who use Microsoft Windows Media Formats

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately

Security Update Replacement: None

Caveats: None

Tested Software and Security Update Download Locations:

Affected Software:
Top of sectionTop of section
•

Microsoft Windows Media Format 7.1 through 9.5 Series Runtime on the following operating system versions:
•

Microsoft Windows 2000 Service Pack 4 - Download the update (KB923689)
•

Microsoft Windows XP Service Pack 2 - Download the update (KB923689)
•

Microsoft Windows XP Professional x64 Edition - Download the update (KB923689)
•

Microsoft Windows Server 2003 or Microsoft Windows Server 2003 Service Pack 1 - Download the update (KB923689)
•

Microsoft Windows Server 2003 x64 Edition - Download the update (KB923689)
•

Microsoft Windows Media Format 9.5 Series Runtime x64 Edition on the following operating system versions:
•

Microsoft Windows XP Professional x64 Edition - Download the update (KB923689)
•

Microsoft Windows Server 2003 x64 Edition - Download the update (KB923689)
•

Microsoft Windows Media Player 6.4
•

Windows 2000 Service Pack 4 - Download the update (KB925398)
•

Microsoft Windows XP Service Pack 2 - Download the update (KB925398)
•

Microsoft Windows XP Professional x64 Edition – Download the update (KB925398)
•

Microsoft Windows Server 2003 or on Microsoft Windows Server 2003 Service Pack 1 – Download the update (KB925398)
•

Microsoft Windows Server 2003 x64 Edition – Download the update (KB925398)

Non-Affected Software:
•

Windows Vista
•

Microsoft Windows 2003 For Itanium-Based Systems and Windows Server 2003 with SP1 for Itanium-based Systems
•

Windows Media Format 11 Series when installed on all Microsoft Operating Systems

Note The security updates for Microsoft Windows Server 2003, Windows Server 2003 Service Pack 1, and Windows Server 2003 x64 Edition also apply to Windows Server 2003 R2.

The software in this list has been tested to determine whether the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support life cycle for your product and version, visit the Microsoft Support Lifecycle Web site.
General Information

Executive Summary

Executive Summary:

This update resolves two newly discovered vulnerabilities. These vulnerabilities are documented in the "Vulnerability Details" section of this bulletin.

If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

We recommend that customers apply the update immediately.

Severity Ratings and Vulnerability Identifiers:
Vulnerability Identifiers Impact of Vulnerability Windows Media Player 6.4 (All operating systems) Windows 2000 Service Pack 4 Windows XP Service Pack 2 and Windows XP Professional x64 Edition Windows Server 2003, Windows Server 2003 Service Pack 1 and Microsoft Windows Server 2003 x64 Edition

Windows Media Format ASF Parsing Vulnerability CVE-2006-4702

Remote Code Execution

Critical

Windows Media Format ASX Parsing Vulnerability CVE-2006-6134

Remote Code Execution

Not Applicable

Critical

Aggregate Severity of All Vulnerabilities

Critical

This assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.
Top of sectionTop of section

Frequently Asked Questions (FAQ) Related to this Security Update

Do I need to install both the Windows Media Format Series Runtime update and the Microsoft Windows Media Player 6.4 update?
Yes, there may be situations where you need to install both updates. That is because the Windows Media Player 6.4 updates a different file than the Windows Media Format Series Runtime, which is also affected by this vulnerability.

Do I need to install both the Windows Media Format Series Runtime update, Windows Media Format 9.5 Series Runtime for Windows XP Professional x64, Windows Media Format 9.5 Series Runtime x64 Edition for Windows XP Professional x64update and the Microsoft Windows Media Player 6.4 update for Windows XP Professional x64?
Yes, there may be situations where you need to install all three updates. That is because the Windows Media Player 6.4, Windows Media Format 9.5 Series Runtime x64 Edition and the Windows Media Format 9.5 Runtime for Windows XP Professional x64 Edition update a different file than the Windows Media Format Series Runtime, which is also affected by this vulnerability.

I have installed Windows Media Player 11 on my computer. Why am I being offered the Windows Media Player 6.4 security update?
While Windows Media Player 11 is not vulnerable, Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows XP Professional x64 Edition, Microsoft Windows Server 2003 or on Microsoft Windows Server 2003 Service Pack 1 and Microsoft Windows Server 2003 x64 Edition will still have Windows Media Player 6.4 installed on the system for backwards compatibility.

Extended security update support for Microsoft Windows XP Home Edition Service Pack 1 or Service Pack 1a, Windows XP Media Center Edition 2002 Service Pack 1, Windows XP Media Center Edition 2004 Service Pack 1, Windows XP Professional Service Pack 1 or Service Pack 1a, and Windows XP Tablet PC Edition Service Pack 1 ended on October 10, 2006. I am still using one of these operating systems; what should I do?
Windows XP (all versions) Service Pack 1 has reached the end of its support life cycle. It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit the following Microsoft Support Lifecycle Web site. For more information about the extended security update support period for these operating system versions, visit the Microsoft Product Support Services Web site.

Extended security update support for Microsoft Windows 98, Windows 98 Second Edition, or Windows Millennium Edition ended on July 11, 2006. I am still using one of these operating systems; what should I do?
Windows 98, Windows 98 Second Edition, and Windows Millennium Edition have reached the end of their support life cycles. It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit the following Microsoft Support Lifecycle Web site. For more information about the extended security update support period for these operating system versions, visit the Microsoft Product Support Services Web site.

Extended security update support for Microsoft Windows NT Workstation 4.0 Service Pack 6a and Windows 2000 Service Pack 2 ended on June 30, 2004. Extended security update support for Microsoft Windows NT Server 4.0 Service Pack 6a ended on December 31, 2004. Extended security update support for Microsoft Windows 2000 Service Pack 3 ended on June 30, 2005. I am still using one of these operating systems. What should I do?
Windows NT Workstation 4.0 Service Pack 6a, Windows NT Server 4.0 Service Pack 6a, Windows 2000 Service Pack 2, and Windows 2000 Service Pack 3 have reached the end of their life cycles. It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit the following Microsoft Support Lifecycle Web site. For more information about the extended security update support period for these operating system versions, visit the Microsoft Product Support Services Web site.

Customers who require custom support for these products must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, visit the Microsoft Worldwide Information Web site, select the country, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Windows Operating System Product Support Lifecycle FAQ.

Can I use the Microsoft Baseline Security Analyzer (MBSA) or the Enterprise Update Scan Tool (EST) to determine whether this update is required?

The following table provides the MBSA detection summary for this security update.
Product MBSA 1.2.1 Enterprise Update Scan Tool (EST)? MBSA 2.0

Windows Media Player 6.4 on Microsoft Windows 2000 Service Pack 4

Yes

Not Applicable

Yes

Windows Media Player 6.4 on Windows XP Service Pack 2

Yes

Not Applicable

Yes

Windows Media Player 6.4 on Microsoft Windows XP Professional x64 Edition

Not Applicable

Yes

Windows Media Player 6.4 on Microsoft Windows Server 2003 or on Microsoft Windows Server 2003 Service Pack 1

Yes

Not Applicable

Yes

Windows Media Player 6.4 on Microsoft Windows Server 2003 x64 Edition

Not Applicable

Yes

Windows Media Format Series Runtime on Windows 2000 Service Pack 4

Yes

Microsoft Windows Media Format Series Runtime Microsoft Windows XP Service Pack 2

Yes

Microsoft Windows Media Format Series Runtime for Microsoft Windows XP Professional x64 Edition

Yes

Microsoft Windows Media Format Series Runtime for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1

Yes

Microsoft Windows Media Format Series Runtime for Microsoft Windows Server 2003 x64 Edition family

Yes

For more information about MBSA, visit the MBSA Web site. For more information about the programs that Microsoft Update and MBSA 2.0 currently do not detect, see Microsoft Knowledge Base Article 895660.

What is the Enterprise Update Scan Tool (EST)?
As part of an ongoing commitment to provide detection tools for bulletin-class security updates, Microsoft delivers a stand-alone detection tool whenever the Microsoft Baseline Security Analyzer (MBSA) and the Office Detection Tool (ODT) cannot detect whether the update is required for an MSRC release cycle. This stand-alone tool is called the Enterprise Update Scan Tool (EST) and is designed for enterprise administrators. When a version of the Enterprise Update Scan Tool is created for a specific bulletin, customers can run the tool from a command line interface (CLI) and view the results of the XML output file. To help customers better utilize the tool, detailed documentation will be provided with the tool. There is also a version of the tool that offers an integrated experience for SMS administrators.

Can I use a version of the Enterprise Update Scan Tool (EST) to determine whether this update is required?
Yes. Microsoft has created a version of the EST that will determine if you have to apply this update. For download links and more information about the version of the EST that is being released this month, see the following Microsoft Web site. SMS customers should review the "Can I use Systems Management Server (SMS) to determine whether this update is required?" FAQ for more information about SMS and EST.

Can I use Systems Management Server (SMS) to determine whether this update is required?

The following table provides the SMS detection summary for this security update.
Product SMS 2.0 SMS 2003

Windows Media Player 6.4 on Microsoft Windows 2000 Service Pack 4

Yes

Windows Media Player 6.4 on Windows XP Service Pack 2

Yes

Windows Media Player 6.4 on Microsoft Windows XP Professional x64 Edition

Yes

Windows Media Player 6.4 on Microsoft Windows Server 2003 or on Microsoft Windows Server 2003 Service Pack 1

Yes

Windows Media Player 6.4 on Microsoft Windows Server 2003 x64 Edition

Yes

Windows Media Format Series Runtime on Windows 2000 Service Pack 4

Yes (with EST)

Yes

Microsoft Windows Media Format Series Runtime Microsoft Windows XP Service Pack 2

Yes (with EST)

Yes

Microsoft Windows Media Format Series Runtime for Microsoft Windows XP Professional x64 Edition

Yes (with EST)

Yes

Microsoft Windows Media Format Series Runtime for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1

Yes (with EST)

Yes

Microsoft Windows Media Format Series Runtime for Microsoft Windows Server 2003 x64 Edition family

Yes (with EST)

Yes

SMS uses MBSA for detection. Therefore, SMS has the same limitation that is listed earlier in this bulletin related to programs that MBSA does not detect.

For SMS 2.0, the SMS SUS Feature Pack, which includes the Security Update Inventory Tool, can be used by SMS to detect security updates. SMS SUIT uses the MBSA 1.2.1 engine for detection. For more information about the Security Update Inventory Tool, visit the following Microsoft Web site. For more information about the limitations of the Security Update Inventory Tool, see Microsoft Knowledge Base Article 306460. The SMS SUS Feature Pack also includes the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications.

For SMS 2003, the SMS 2003 Inventory Tool for Microsoft Updates can be used by SMS to detect security updates that are offered by Microsoft Update and that are supported by Windows Server Update Services. For more information about the SMS 2003 Inventory Tool for Microsoft Updates, visit the following Microsoft Web site. SMS 2003 can also use the Microsoft Office Inventory Tool to detect required updates for Microsoft Office applications.

For more information about SMS, visit the SMS Web site.

For more detailed information, see Microsoft Knowledge Base Article 910723.
Top of sectionTop of section

Vulnerability Details

Windows Media Format ASF Parsing Vulnerability - CVE-2006-4702

A remote code execution vulnerability exists in Windows Media Format Runtime due to the way it handles Advanced Systems Format (ASF) files. An attacker could exploit the vulnerability by constructing specially crafted Windows Media Player content that could potentially allow remote code execution if a user visits a malicious Web site or opens an e-mail message with malicious content. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Mitigating Factors for Windows Media Format ASF Parsing Vulnerability - CVE-2006-4702:
•

In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.
•

An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
•

Windows Media Format 11 Runtime is not affected by this vulnerability and could be used to prevent an attempt to exploit this vulnerability.
Top of sectionTop of section

Workarounds for Windows Media Format ASF Parsing Vulnerability - CVE-2006-4702:

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

Note The following steps require Administrator privileges. We recommend that you restart the computer after you apply this workaround. Alternatively, you can log out and log back in after you apply the workaround.
•

Prevent the Microsoft Windows Media Player ActiveX controls from running in Internet Explorer.

You can help prevent attempts to instantiate this ActiveX control in Internet Explorer by setting the kill bit for the control in the registry.

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

For detailed steps that you can use to prevent a control from running in Internet Explorer, see Microsoft Knowledge Base Article 240797. Follow these steps in this article to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer.

Windows Media Player 6.4

To set the kill bit for a CLSID with a value of {22D6F312-B0F6-11D0-94AB-0080C74C7E95}, paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}]

"Compatibility Flags"=dword:00000400

Windows Media Player 7.1, 9 and 10

To set the kill bit for a CLSID with a value of {6BF52A52-394A-11D3-B153-00C04F79FAA6}, paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6BF52A52-394A-11D3-B153-00C04F79FAA6}]

"Compatibility Flags"=dword:00000400

You can apply this .reg file to individual systems by double-clicking it. You can also apply it across domains by using Group Policy. For more information about Group Policy, visit the following Microsoft Web sites:

Group Policy collection

What is Group Policy Object Editor?

Core Group Policy tools and settings

Note You must restart Internet Explorer for your changes to take effect.

Impact of Workaround: Web sites that use the Windows Media Player ActiveX Controls may no longer display or function correctly.
Top of sectionTop of section

FAQ for Windows Media Format ASF Parsing Vulnerability - CVE-2006-4702:

What is the scope of the vulnerability?
A remote code execution vulnerability exists in the Windows Media Format Runtime due to the way it handles the processing of Advanced Systems Format files (ASF). An attacker could exploit the vulnerability by constructing specially crafted Windows Media Format content that could potentially allow remote code execution if a user visits a malicious Web site or opens a specially crafted ASF format file in an e-mail message.

What causes the vulnerability?
An unchecked buffer overrun in the ASF processing code within Windows Media Format Runtime.

What is Windows Media Player?
Windows Media Player is a feature of the Windows operating system for personal computers. It is used for playing audio and video.

What is Windows Media Format Runtime?
The Microsoft Windows Media Format Runtime provides information and tools for applications which use Windows Media content. For more information, see the product documentation.

What is Advanced Systems Format (ASF)?
ASF (Advanced Systems Format) is a file format that stores audio and video information and is specially designed to run over networks like the Internet. It is compressed format that contains streaming audio, video, slide shows, and synchronized events. ASF enables content to be delivered to you as a continuous flow of data. ASF files may have the file extension ASF, WMV, or WMA.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

How could an attacker exploit the vulnerability?
An attacker could host a specially crafted Web site that is designed to exploit these vulnerabilities through Internet Explorer and then persuade a user to view the Web site. This can also include Web sites that accept user-provided content or advertisements, Web sites that host user-provided content or advertisements, and compromised Web sites. These Web sites could contain specially crafted content that could exploit these vulnerabilities. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger message that takes users to the attacker's Web site. It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems.

In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially crafted file to the user and by persuading the user to open the file.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.

What does the update do?
The update removes the vulnerability by modifying the way that Windows Media Format Runtime validates the length of data in the media data before passing the file to the allocated buffer.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.
Top of sectionTop of section
Top of sectionTop of section

Windows Media Format ASX Parsing Vulnerability - CVE-2006-6134

A remote code execution vulnerability exists in Windows Media Format Runtime due to the way it handles certain elements contained in Advanced Stream Redirector (ASX) files. An attacker could exploit the vulnerability by constructing a specially crafted ASX file that could allow remote code execution if a user visits a malicious Web site, where specially crafted ASX files are used to launch Windows Media player, or if a user clicks on a URL pointing to a specially crafted ASX file. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Mitigating Factors for Windows Media Format ASX Parsing Vulnerability - CVE-2006-6134:
•

By default, all supported versions of Microsoft Outlook and Microsoft Outlook Express open HTML e-mail messages in the Restricted sites zone. The Restricted sites zone helps reduce attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail. However, if a user clicks on a link within an e-mail they could still be vulnerable to this issue through the Web-based attack scenario. Similarly, a user would still be at risk if opening an e-mail attachment.
•

Windows Media Format 11 Runtime, Windows Media Format Runtime 7.1, and Windows Media Player 6.4 are not affected by this vulnerability.
Top of sectionTop of section

Workarounds for Windows Media Format ASX Parsing Vulnerability - CVE-2006-6134:

Install Windows Media Player 11, which includes Windows Media Format Runtime 11

Install Windows Media Player 11 on Microsoft Windows XP Home Edition Service Pack 2, Windows XP Professional Service Pack 2, Windows XP Tablet PC Edition 2005, Windows XP Media Center Edition 2005 with KB900325, or Windows XP Professional x64 Edition. For more information about Windows Media Player 11 you can visit the Windows Media Player Home Web page.

Impact of Workaround: None.
•

Prevent the Microsoft Windows Media Player ActiveX controls from running in Internet Explorer.

You can help prevent attempts to instantiate this ActiveX control in Internet Explorer by setting the kill bit for the control in the registry. This workaround will not provide protection from all attack vectors.

Windows Media Player 9 and 10

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6BF52A52-394A-11D3-B153-00C04F79FAA6}]

"Compatibility Flags"=dword:00000400

Group Policy collection

What is Group Policy Object Editor?

Core Group Policy tools and settings

Note You must restart Internet Explorer for your changes to take effect.

Impact of Workaround

When you disable the Windows Media Player ActiveX control, pages using this control will no longer function as designed. This prevents any content from being played though the control, including audio and video
Top of sectionTop of section

FAQ for Windows Media Format ASX Parsing Vulnerability - CVE-2006-6134:

What is the scope of the vulnerability?
A remote code execution vulnerability exists in Windows Media Format Runtime due to the way it handles certain elements contained in Advanced Stream Redirector (ASX) files. An attacker could exploit the vulnerability by constructing specially crafted ASX files that could potentially allow remote code execution if a user visits a malicious Web site or opens a specially crafted ASX file in an e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

What causes the vulnerability?
The processing code within Windows Media Format Runtime which handles certain URLs included in ASX files.

What is Windows Media Player?
Windows Media Player is a feature of the Windows operating system for personal computers. It is used for playing audio and video.

What is Advanced Stream Redirector (ASX)?
ASX (Advanced Stream Redirector) format is a type of XML metafile designed to store a list of Windows Media files to play during a multimedia presentation. It is used frequently on streaming video servers where multiple ASF files are to be played in succession. Both RTSP and MMS streaming protocols are supported, as well as HTTP. ASX files have MIME type video/x-ms-asf (as do ASF files).

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially crafted file to the user and by persuading the user to open the file.

What does the update do?
The update removes the vulnerability by modifying the way that Windows Media Format Runtime validates the length of data in the before passing the data to the allocated buffer.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
Yes. This vulnerability had been publicly disclosed when this security bulletin was originally issued. It has been assigned the Common Vulnerability and Exposure number CVE-2006-6134.

Disclaimer:

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:
•

V1.0 (December 12, 2006): Bulletin published.