Re: Microsoft Security Bulletin MS02-027 UPDATE: Patch now available

From: Jerry Bryant [MS] (jbryant@online.microsoft.com)
Date: 06/14/02 

From: "Jerry Bryant [MS]" <jbryant@online.microsoft.com>
Date: Fri, 14 Jun 2002 14:16:31 -0700

Title: Unchecked Buffer in Gopher Protocol Handler Can Run Code
            of Attacker's Choice (Q323889)
Released: 11 June 2002
Revised: 14 June 2002 (version 2.0)
Software: Internet Explorer, Proxy Server, Internet Security and
            Acceleration Server
Impact: Run Code of Attacker's Choice
Max Risk: Critical
Bulletin: MS02-027

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS02-027.asp.
- ----------------------------------------------------------------------

Reason for Revision:
====================
On June 11, 2002, Microsoft released the original version of this bulletin.
In it, we detailed a work-around procedure that customers could implement
to protect themselves against a publicly disclosed
vulnerability. An updated version of this bulletin was rereleased on June
14, 2002 to announce the availability of patches for Proxy Server 2.0 and
ISA Server 2000 and to advise customers that the work-around procedure is no
longer needed on those platforms. Patches for IE are forthcoming and this
bulletin will be re-released to announce their availability.

Issue:
======
This is a work-around bulletin that details steps customers can take to
protect themselves against a publicly disclosed vulnerability until patches
are available.

The Gopher protocol is a legacy protocol that provides for the transfer of
text-based information across the Internet. Information on Gopher servers is
hierarchically presented using a menu system, and multiple Gopher servers
can be linked together to form a collective "Gopherspace".

There is an unchecked buffer in a piece of code which handles the response
from Gopher servers. This code is used independently in IE, ISA, and Proxy
Server. A security vulnerability results because it is possible for an
attacker to attempt to exploit this flaw by mounting a buffer overrun attack
through a specially crafted server response. The attacker could seek to
exploit the vulnerability by crafting a web page that contacted a server
under the attacker's control. The attacker could then either post this page
on a web site or send it as an HTML email. When the page was displayed and
the server's response received and processed, the attack would be carried
out.

A successful attack requires that the attacker be able to send information
to the intended target using the Gopher protocol. Anything which inhibited
Gopher connectivity could protect against attempts to exploit this
vulnerability. In the case of IE, the code would be run in the user's
context. As a result, any limitations on the user would apply to the
attacker's code as well.

Mitigating Factors:
====================
 - A successful attack requires that the attacker's server be
   able to deliver information to the target using the Gopher
   protocol. Customers who block Gopher at the perimeter would be
   protected against attempts to exploit this vulnerability across
   the Internet.

 - In the case of IE, code would run in the security context of
   the user. As a result, any limitations on the user's ability
   would also restrict the actions an attacker's code could take.

 - A successful attack against ISA and Proxy servers would
   require that the malicious response be received by the web
   proxy service. In practical terms, this means that a proxy
   client would have to submit the initial request through the
   proxy server.

Risk Rating:
============
 - Internet systems: Critical
 - Intranet systems: Critical
 - Client systems: Critical

Patch Availability:
===================
 - A patch is currently under development to fix this
   vulnerability. Please read the Security Bulletin at
   http://www.microsoft.com/technet/security/bulletin/ms02-027.asp
   for workaround information while patches are developed.

- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES
DO
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. 

--
Regards,
Jerry Bryant - MCSE, MCDBA
Microsoft IT Communities
Get Secure! www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.
"Jerry Bryant [MS]" <jbryant@online.microsoft.com> wrote in message
news:O4XzzEaECHA.1964@tkmsftngp03...
> Title:      Unchecked Buffer in Gopher Protocol Handler Can Run Code
>             of Attacker's Choice (Q323889)
> Date:       11 June 2002
> Software:   Internet Explorer, Proxy Server, Internet Security and
>             Acceleration Server
> Impact:     Run Code of Attacker's Choice
> Max Risk:   Critical
> Bulletin:   MS02-027
>
> Microsoft encourages customers to review the Security Bulletin at:
> http://www.microsoft.com/technet/security/bulletin/MS02-027.asp.
> - ----------------------------------------------------------------------
>
> Issue:
> ======
> This is a work-around bulletin that details steps customers can take to
> protect themselves against a publicly disclosed vulnerability until
patches
> are available.
>
> The Gopher protocol is a legacy protocol that provides for the transfer of
> text-based information across the Internet. Information on Gopher servers
is
> hierarchically presented using a menu system, and multiple Gopher servers
> can be linked together to form a collective "Gopherspace".
>
> There is an unchecked buffer in a piece of code which handles the response
> from Gopher servers. This code is used independently in IE, ISA, and Proxy
> Server. A security vulnerability results because it is possible for an
> attacker to attempt to exploit this flaw by mounting a buffer overrun
attack
> through a specially crafted server response. The attacker could seek to
> exploit the vulnerability by crafting a web page that contacted a server
> under the attacker's control. The attacker could then either post this
page
> on a web site or send it as an HTML email. When the page was displayed and
> the server's response received and processed, the attack would be carried
> out.
>
> A successful attack requires that the attacker be able to send information
> to the intended target using the Gopher protocol. Anything which inhibited
> Gopher connectivity could protect against attempts to exploit this
> vulnerability. In the case of IE, the code would be run in the user's
> context. As a result, any limitations on the user would apply to the
> attacker's code as well.
>
>
> Mitigating Factors:
> ====================
>  - A successful attack requires that the attacker's server be
>    able to deliver information to the target using the Gopher
>    protocol. Customers who block Gopher at the perimeter would be
>    protected against attempts to exploit this vulnerability across
>    the Internet.
>
>  - In the case of IE, code would run in the security context of
>    the user. As a result, any limitations on the user's ability
>    would also restrict the actions an attacker's code could take.
>
>  - A successful attack against ISA and Proxy servers would
>    require that the malicious response be received by the web
>    proxy service. In practical terms, this means that a proxy
>    client would have to submit the initial request through the
>    proxy server.
>
> Risk Rating:
> ============
>  - Internet systems: Critical
>  - Intranet systems: Critical
>  - Client systems: Critical
>
> Patch Availability:
> ===================
>  - A patch is currently under development to fix this
>    vulnerability. Please read the Security Bulletin at
>    http://www.microsoft.com/technet/security/bulletin/ms02-027.asp
>    for workaround information while patches are developed.
>
> - ---------------------------------------------------------------------
>
> THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
> PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
> WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
> WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
> EVENT
> SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES
> WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF
> BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS
> SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES
> DO
> NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR
> INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
>
>
> --
> Regards,
>
> Jerry Bryant - MCSE, MCDBA
> Microsoft IT Communities
>
> Get Secure! www.microsoft.com/security
>
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>

Relevant Pages

  • Microsoft Security Bulletin MS02-027
    ... Unchecked Buffer in Gopher Protocol Handler Can Run Code ... Internet Explorer, Proxy Server, Internet Security and ... attacker to attempt to exploit this flaw by mounting a buffer overrun attack ...
    (microsoft.public.security)
  • Microsoft Security Bulletin MS02-027 v2.0
    ... Unchecked Buffer in Gopher Protocol Handler Can Run Code ... Internet Explorer, Proxy Server, Internet Security and ... attacker to attempt to exploit this flaw by mounting a buffer overrun attack ...
    (microsoft.public.security)
  • [NT] Unchecked Buffer in Gopher Protocol Handler Can Run Code of Attackers Choice
    ... protect themselves against a publicly disclosed vulnerability until ... The Gopher protocol is a legacy protocol that provides for the transfer of ... Information on Gopher servers ... attack through a specially crafted server response. ...
    (Securiteam)
  • [REVS] NTLM HTTP Authentication is Insecure By Design
    ... in front of a web server, and that proxy server shares a single TCP ... These are attacks that make use of non-RFC HTTP requests (HTTP Request ... the authentication is associated with the ...
    (Securiteam)
  • Gopher FAQ
    ... This is the first version of the updated Gopher FAQ. ... Where can I get Gopher software? ... How can I set up a "CSO" phone book server? ... What e-mail/usenet discussions lists are active for Gopher? ...
    (comp.infosystems.gopher)
Loading