Bugtraq mailing list archives
Microsoft Security Bulletin MS01-013
From: Microsoft Product Security <secnotif () MICROSOFT COM>
Date: Mon, 26 Feb 2001 13:54:49 -0800
The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. ******************************** -----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Windows 2000 Event Viewer Contains Unchecked Buffer Date: February 26, 2001 Software: Windows 2000 Impact: Run code of attacker's choice Bulletin: MS01-013 Microsoft encourages customers to review the Security Bulletin at: http://www.microsoft.com/technet/security/bulletin/MS01-013.asp. - ---------------------------------------------------------------------- Issue: ====== The Windows 2000 event viewer snap-in has an unchecked buffer in a section of the code that displays the detailed view of event records. If the event viewer attempted to display an event record that contained specially malformed data in one of the fields, either of two outcomes would result. In the less serious case, the event viewer would fail. In the more serious case, code of the attacker's choice could be made to run via a buffer overrun. By design, unprivileged processes can log events in the System and Application logs, and interactively logged-on, unprivileged users can view them. However, only privileged processes can log events in the Security log, and only interactively logged-on administrators can view them. If the vulnerability were exploited to run code of the attacker's choice, the code would run in the security context of the user who viewed the affected record. Mitigating Factors: ==================== - Simply perusing the listing of events in a log would not allow the vulnerability to be exploited. It could only be exploited if the user opened an affected record to view the event details. - Although the Event Viewer is generally thought of as an administrative tool, there is no guarantee that the user who opens a particular event record would be privileged. Unprivileged users can read the System and Application logs. Although the Security log can only be read by privileged users, only privileged processes can write to it. - To the best of our knowledge, it is not possible to manipulate the normal auditing functions of any Windows 2000 service in order to create an event record that would exploit this vulnerability. Instead, a custom piece of code would need to be created and run to create such a record. - If firewalling and other appropriate precautions have been taken, only authenticated users will have access to network machines and be able to write event log records. Patch Availability: =================== - A patch is available to fix this vulnerability. Please read the Security Bulletin http://www.microsoft.com/technet/security/bulletin/ms01-013.asp for information on obtaining this patch. Acknowledgment: =============== - Blake Watts of Guardent (http://www.guardent.com) - --------------------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.3 iQEVAwUBOprQmY0ZSRQxA/UrAQGGpgf/ZxvSC+9sp7ThlvyNkgNjyIG6QqieegtC K/5VbqsA2JtvSOYFOVXUG/JJIsDhFCumXGt33RJX83mAMgqSDYCXmO+17UrXqr5w HLNX4BNLyx/nlEATXVj3/fiz55XYCVNCXFgIlZ7xYP1PvfTKGfEsK8wkkmLlSZDo fDFGCXcEFX8CCAhwnDiMPCfI7yXPll33e2Tad2Zd067zOGr+WXuLHC3x9blQL7WE QjcSaxCeVawHA2UtoI7zEZvnynZrpfHCQK3iL/A73tOiArvATS4AjaSA3iqMGrYS POGcgTPTaUeZUbdIxTa17cb7fiwjmntYZ/tIYuumIVeaLaqjPi7sxA== =/a0Y -----END PGP SIGNATURE----- ******************************************************************* You have received this e-mail bulletin as a result of your registration to the Microsoft Product Security Notification Service. You may unsubscribe from this e-mail notification service at any time by sending an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST () ANNOUNCE MICROSOFT COM The subject line and message body are not used in processing the request, and can be anything you like. To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp. For more information on the Microsoft Security Notification Service please visit http://www.microsoft.com/technet/security/notify.asp. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.
Current thread:
- Microsoft Security Bulletin MS01-013 Microsoft Product Security (Feb 27)