Re: New attack vectors and a vulnerability dissection of MS03-007

• Previous message: Russ: "Re: IIS 5: strange problems handling certain file names"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date:         Mon, 7 Apr 2003 11:47:14 -0500
From: "J. Merrill" <jvm_cop@SPAMCOP.NET>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

I looked again at MS's writings on this

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-007.asp
http://support.microsoft.com/default.aspx?scid=kb;en-us;815021

and have not seen anything that indicates that machines not running IIS, or that have WebDAV turned off, are vulnerable. Is MS deliberately hiding that information from even those who read their security bulletins (showing again, as if we needed it, how important it is for us to subscribe to NTBUGTRAQ), or do they not believe that the problem exists, or what?

At 04:16 PM 3/21/2003 +0000, David Litchfield wrote
>The patch announced by Microsoft on the 17th March 2003 fixed a security
>vulnerability in the core of the Windows 2000 operating system. This flaw
>was actively being exploited through WebDAV requests to Microsoft's Internet
>Information Server 5. It must be stressed that IIS was simply the attack
>vector; the method or route used to actually exploit the flaw. The problem,
>however, is much wider in scope than just simply machines running IIS.
>Researchers at NGSSoftware have isolated many more attack vectors including
>java based web servers and other non-WebDAV related issues in IIS. Due to
>this, NGSSoftware urge Windows 2000 users to apply the patch.
>
>For a paper that examines the vulnerability in detail, please read
>http://www.ngssoftware.com/papers/ms03-007-ntdll.pdf .
>
>Cheers,
>David Litchfield
>NGSSoftware Ltd
>+44(0)208 401 0070
>http://www.ngssoftware.com/

J. Merrill / Analytical Software Corp

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by Prometric - More than testing, learning.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
http://www.prometric.com

Prometric, part of The Thomson Corporation, is the leader in
technology-enabled testing and assessment services for information
technology certification, academic admissions, professional licensure and
certifications, computer-based driver's licensing, and corporate testing.

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

• Previous message: Russ: "Re: IIS 5: strange problems handling certain file names"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]