Microsoft RPC Locator Buffer Overflow Vulnerability (#NISR29012003)

From: NGSSoftware Insight Security Research (nisr@NEXTGENSS.COM)
Date: 01/30/03

  • Next message: Russ: "Blackboard and Slammer" 
    Date:         Thu, 30 Jan 2003 04:27:51 -0000
From: NGSSoftware Insight Security Research <nisr@NEXTGENSS.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    NGSSoftware Insight Security Research Advisory

    Name: Locator Service Buffer Overflow Vulnerability
    Systems Affected: Windows 2000/XP/NT
    Severity: High Risk / Critical
    Category: Buffer Overrun
    Vendor URL: http://www.microsoft.com/
    Author: David Litchfield (david@ngssoftware.com)
    Date: 29th January 2003
    Advisory number: #NISR29012003
    Tool: http://www.ngssoftware.com/rpclocator.html

    Description
    ***********
    There is a remotely exploitable buffer overflow vulnerability in the
    Microsoft RPC (Remote Procedure Call) Locator Service on Windows platforms.
    The RPC Locator Service maintains a list of RPC services and servers on the
    network. Typically only domain controllers run the Locator service by
    default and these machines are the most at risk.

    Details
    *******
    When searching for RPC Services on the network a Windows RPC client will
    connect to the domain controller over TCP port 139/445 (the SMB ports) and
    search for services/servers through the "locator" named pipe. An attacker
    can overflow a stack based buffer in the Locator service process by
    searching for an overly long string for an entry name to use in looking for
    binding handles. This problem arises due to an unsafe call to wcscpy().

    Fix Information
    ***************
    NGSSoftware advised Microsoft to this problem at the end of October of 2002.
    Microsoft released the patch to resolve this issue last week.

    http://www.microsoft.com/security/security_bulletins/ms03-001.asp

    NGSSoftware have written a free command line scanner to locate Microsoft
    computers running the RPC Locator service on the network. This may be
    downloaded from the NGSSite. [Please note that this scanner does not test
    for the actual vulnerability, but rather helps locate those machines most at
    risk. Although sample exploit code has been provided to the vendor, due to
    the recent events of last weekend, NGSSoftware are loathe to publish this
    publicly at this juncture - however we may after a grace period.]

    http://www.ngssoftware/rpclocator.html

    A check for this issue is already in Typhon, NGSSoftware's advanced
    vulnerability assessment scanner, of which more information is available
    from the NGSSite, http://www.ngssoftware.com.

    Further Information
    *******************
    For further information about the scope and effects of buffer overflows,
    please see

    http://www.ngssoftware.com/papers/non-stack-bo-windows.pdf
    http://www.ngssoftware.com/papers/ntbufferoverflow.html
    http://www.ngssoftware.com/papers/bufferoverflowpaper.rtf
    http://www.ngssoftware.com/papers/unicodebo.pdf

    About NGSSoftware
    *****************
    NGSSoftware design, research and develop intelligent, advanced application
    security assessment scanners. Based in the United Kingdom, NGSSoftware have
    offices in the South of London and the East Coast of Scotland. NGSSoftware's
    sister company NGSConsulting, offers best of breed security consulting
    services, specialising in application, host and network security
    assessments.

    http://www.ngssoftware.com/
    http://www.ngsconsulting.com/

    Telephone +44 208 401 0070
    Fax +44 208 401 0076

    enquiries@ngssoftware.com

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Delivery co-sponsored by TruSecure Corporation
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    TICSA - Anniversary Special - Limited Time

    Become TICSA certified for just $221.25 US when you register before 3/31/03
    with PROMO "TS0103" at www.2test.com. NO membership fees, certification
    good for 2 years. Price for international delivery just $296.25 US, with
    this offer. Offer cannot be combined with any other special and expires
    3/31/03. Visit www.trusecure.com/ticsa for full details.

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

    Relevant Pages