MS Sec Notification mailing list archives
REVISED: Microsoft Security Bulletin MS03-007: Unchecked Buffer In Windows Component Could Cause Server Compromise (815021)
From: "Microsoft" <0_48428_04BF067D-4CF8-4245-B5C1-58573E5746A8_US () Newsletters Microsoft com>
Date: Wed, 28 May 2003 17:09:26 -0700
-----BEGIN PGP SIGNED MESSAGE----- - - ----------------------------------------------------------------- Title: Unchecked Buffer In Windows Component Could Cause Server Compromise (815021) Released: 17 Mar 2003 Revised: 28 May 2003 (version 3.0) Software: Microsoft (r) Windows (r) NT 4.0, Windows 2000 and Windows XP Impact: Run code of attacker's choice Max Risk: Critical Bulletin: MS03-007 Microsoft encourages customers to review the Security Bulletin at: http://www.microsoft.com/technet/security/bulletin/MS03-007.asp http://www.microsoft.com/security/security_bulletins/ms03-007.asp - - ----------------------------------------------------------------- Reason for Revision: ==================== Microsoft originally released this security bulletin on March 17, 2003. At that time, Microsoft was aware of a publicly available exploit that was being used to attack Windows 2000 Servers running IIS 5.0. The attack vector in this case was WebDAV although the underlying vulnerability was in a core operating system component, ntdll.dll. Microsoft issued a patch to protect Windows 2000 customers shortly afterwards, but also continued to investigate the underlying vulnerability. During the course of that investigation, Microsoft found that Windows NT 4.0 also contains the underlying vulnerability in ntdll.dll, however it does not support WebDAV and therefore the known exploit was not effective against Windows NT 4.0. In addition, Microsoft has recently been made aware of this vulnerability as well in Windows XP. However, like Windows NT 4.0, Windows XP does not install Internet Information Services (IIS) by default. Microsoft has now released patches for Windows NT 4.0 and Windows XP. Issue: ====== Microsoft Windows 2000 supports the World Wide Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV, defined in RFC 2518, is a set of extensions to the Hyper Text Transfer Protocol (HTTP) that provide a standard for editing and file management between computers on the Internet. A security vulnerability is present in a Windows component used by WebDAV and results because a core operating system component, ntdll.dll, contains an unchecked buffer. An attacker could exploit the vulnerability by sending a specially formed HTTP request to a machine running Internet Information Server (IIS). The request could cause the server to fail or to execute code of the attacker's choice. The code would run in the security context of the IIS service (which, by default, runs in the LocalSystem context). Although Microsoft has supplied a patch for this vulnerability and recommends all affected customers install the patch immediately, additional tools and preventive measures have been provided that customers can use to block the exploitation of this vulnerability while they are assessing the impact and compatibility of the patch. These temporary workarounds and tools are discussed in the "Workarounds" section in the FAQ below. Mitigating Factors: ==================== - URLScan, which is a part of the IIS Lockdown Tool will block this attack in its default configuration - The vulnerability can only be exploited remotely if an attacker can establish a web session with an affected server - Windows NT 4.0 and Windows XP do not install Internet Information Services by default. - Windows NT 4.0 does not support WebDAV Risk Rating: ============ - Critical Patch Availability: =================== - A patch is available to fix this vulnerability. Please read the Security Bulletins at http://www.microsoft.com/technet/security/bulletin/ms03-007.asp http://www.microsoft.com/security/security_bulletins/ms03-007.asp for information on obtaining this patch. - - ----------------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. -----BEGIN PGP SIGNATURE----- Version: PGP 7.1 iQEVAwUBPtTmDo0ZSRQxA/UrAQHRCQgAi2BdXz6lpYHcyNvPD5l3bp5ETnJg3WDp G8qIK0jFv9qROBhPAnddzhYCiNgJnL+v+4y8XMRqzKXG6AbC2IcLnyDaDXuF8Asz hl22J4BYshoZVP7Sr7Ck7uun82jizguYX5P4t3Ck2TX/JL+A5E9NkcHRgYb1xAzW 7ShgEMyoggplM4XnTjnSm+CfohNGE0EYpAJ/dX1Z4JeSjIdsogfpZ4cb7DEwxhvO tdcp3aA/asBRbxUZHRI0UyYn2e/Hl+W4hDr7Lu3EqeJexI5E/mQZYhgMtiRo+zhK cP+QfsEub1H0DPp+ECMpLMYrDHXfAPH9PwU2Rs+JHGqGZ9r0fHQPnQ== =bjtW -----END PGP SIGNATURE----- ******************************************************************* You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification Service. For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp. To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp. To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at http://register.microsoft.com/regsys/pic.asp If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via email as described below: Reply to this message with the word UNSUBSCRIBE in the Subject line. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.
Current thread:
- Revised: Microsoft Security Bulletin MS03-007: Unchecked Buffer In Windows Component Could Cause Server Compromise (815021) Microsoft (Apr 23)
- <Possible follow-ups>
- REVISED: Microsoft Security Bulletin MS03-007: Unchecked Buffer In Windows Component Could Cause Server Compromise (815021) Microsoft (May 28)