Unchecked Buffer In Windows Component Could Cause

[JnCoKiLLa]

Title: Unchecked Buffer In Windows Component Could Cause

Server Compromise (815021)

Released: 17 Mar 2003

Revised: 28 May 2003 (version 3.0)

Software: Microsoft ® Windows ® NT 4.0, Windows 2000 and

Windows XP

Impact: Run code of attacker's choice

Max Risk: Critical

Bulletin: MS03-007

Microsoft encourages customers to review the Security Bulletin

at:

http://www.microsoft.com/technet/security/...in/MS03-007.asp

http://www.microsoft.com/security/security...ns/ms03-007.asp

- - -----------------------------------------------------------------

Reason for Revision:

====================

Microsoft originally released this security bulletin on March 17,

2003. At that time, Microsoft was aware of a publicly available

exploit that was being used to attack Windows 2000 Servers running

IIS 5.0. The attack vector in this case was WebDAV although the

underlying vulnerability was in a core operating system component,

ntdll.dll. Microsoft issued a patch to protect Windows 2000

customers shortly afterwards, but also continued to investigate the

underlying vulnerability. During the course of that investigation,

Microsoft found that Windows NT 4.0 also contains the underlying

vulnerability in ntdll.dll, however it does not support WebDAV and

therefore the known exploit was not effective against Windows NT

4.0. In addition, Microsoft has recently been made aware of this

vulnerability as well in Windows XP. However, like Windows NT 4.0,

Windows XP does not install Internet Information Services (IIS) by

default. Microsoft has now released patches for Windows NT 4.0 and

Windows XP.

Issue:

======

Microsoft Windows 2000 supports the World Wide Web Distributed

Authoring and Versioning (WebDAV) protocol. WebDAV, defined in

RFC 2518, is a set of extensions to the Hyper Text Transfer

Protocol (HTTP) that provide a standard for editing and file

management between computers on the Internet. A security

vulnerability is present in a Windows component used by WebDAV

and results because a core operating system component, ntdll.dll,

contains an unchecked buffer.

An attacker could exploit the vulnerability by sending a

specially formed HTTP request to a machine running Internet

Information Server (IIS). The request could cause the server to

fail or to execute code of the attacker's choice. The code would

run in the security context of the IIS service (which, by

default, runs in the LocalSystem context).

Although Microsoft has supplied a patch for this vulnerability

and recommends all affected customers install the patch

immediately, additional tools and preventive measures have been

provided that customers can use to block the exploitation of

this vulnerability while they are assessing the impact and

compatibility of the patch. These temporary workarounds and

tools are discussed in the "Workarounds" section in the FAQ

below.

Mitigating Factors:

====================

- URLScan, which is a part of the IIS Lockdown Tool will block

this attack in its default configuration

- The vulnerability can only be exploited remotely if an attacker

can establish a web session with an affected server

- Windows NT 4.0 and Windows XP do not install Internet

Information Services by default.

- Windows NT 4.0 does not support WebDAV

Risk Rating:

============

- Critical

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read the

Security Bulletins at

http://www.microsoft.com/technet/security/...in/ms03-007.asp

http://www.microsoft.com/security/security...ns/ms03-007.asp

for information on obtaining this patch.