ms04-031 pre-auth ??

From: Sinan Eren (sinan.eren_at_immunitysec.com)
Date: 10/18/04

  • Next message: Michal Zalewski: "Web browsers - a mini-farce" 
    Date: Mon, 18 Oct 2004 09:35:22 -0400 (EDT)
To: bugtraq@securityfocus.com, dailydave@lists.immunitysec.com

    http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx

    We have located the vulnerable function and just recently wrote the
    CANVAS module for it but all our tests showed that the NetDDE
    vulnerability can not be exploited with a NULL session a.k.a
    with "Anonymous Logon" credentials.

    Here are some reasons why we think NetDDE rpc interface procedure calls
    can only be done after authentication (any local or domain user)

    1- \pipe\nddeapi named pipe do not have the "Anonymous Logon" credentials
    2- HKLM\SYSTEM\ControlSet001\Services\lanmanserver\parameters\NullSessionPipes
    do not list the nddeapi pipe in any of the current windows OS installs
    3- \pipe\nddeapi is not hardcoded in the srv.sys driver (please check:
    http://www.hsc.fr/ressources/articles/win_net_srv/index.html.en#htoc33 )

    Please feel free to correct us! We will be delighted to hear that this
    vuln is actually a pre-auth ;)

    The most puzzling question is why does Microsoft "upplays" this
    vulnerabilities severity rather than the usual downplaying efforts ?
    I remember a good friend reporting them a remote ring-0 vulnerability
    in terminal services which they silently fixed in SP3 and dont even bother
    to credit him because they simply believe only remote DOS can be achieved
    with a remote kernel overflow!! So does that mean MS changed its policy
    regarding vulnerability severity assesment or they have a ongoing love
    relation with NGS ? puzzles the mind ;)

    cheers,
    Sinan Eren
    Immunity Research

  • Next message: Michal Zalewski: "Web browsers - a mini-farce"

    Relevant Pages

    • [NT] Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow (MS04-031)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... This vulnerability can also be used by any low privileged ... The NetDDE services are designed to be ... communicating with a NetDDE server, ...
      (Securiteam)
    • Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow
      ... NGSSoftware Insight Security Research Advisory ... Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow ... Systems Affected: Microsoft Windows NT/2000/XP/2003 Server ... This vulnerability can also be used by any low privileged local user to ...
      (NT-Bugtraq)
    • Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow
      ... NGSSoftware Insight Security Research Advisory ... Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow ... Systems Affected: Microsoft Windows NT/2000/XP/2003 Server ... This vulnerability can also be used by any low privileged local user to ...
      (Bugtraq)
    • [VulnWatch] Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow
      ... NGSSoftware Insight Security Research Advisory ... Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow ... Systems Affected: Microsoft Windows NT/2000/XP/2003 Server ... This vulnerability can also be used by any low privileged local user to ...
      (VulnWatch)
    • SecurityFocus Microsoft Newsletter #182
      ... Introducing the world's first and only complete Internal Security Gateway: ... Microsoft Windows XP Explorer.EXE Remote Denial of Service V... ... Apache Error Log Escape Sequence Injection Vulnerability ...
      (Focus-Microsoft)