RE: Now Showing: MS05-047 Exploit In-The-Wild

["Fergie (Paul Ferguson)" <fergdawg () netzero net>]

Hey, this could lead to all kinds of "fun", Larry. ;-)

- ferg

-- "Larry Seltzer" <larry () larryseltzer com> wrote:

What the hell's with all this on-topic stuff? I though this was a "fun" list

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
Contributing Editor, PC Magazine
larryseltzer () ziffdavis com 

-----Original Message-----
From: funsec-bounces () linuxbox org [mailto:funsec-bounces () linuxbox org] On
Behalf Of Fergie (Paul Ferguson)
Sent: Friday, October 21, 2005 12:56 PM
To: funsec () linuxbox org
Subject: [funsec] Now Showing: MS05-047 Exploit In-The-Wild

That's right. You should've been patched, like, yesterday.

Personally, I expect to see a worm which uses this exploit to begin
circulating within the next few days.

Via FrSIRT.

[snip]

Microsoft Windows Plug and Play "Umpnpmgr.dll" Remote Exploit (MS05-047)

Exploits this advisory:

Advisory ID : FrSIRT/ADV-2005-2044
CVE ID : CVE-2005-2120
Rated as : High Risk
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-10-11

* Technical Description *

A vulnerability has been identified in Microsoft Windows, which may be
exploited by attackers to execute abitrary commands or by malicious users to
obtain elevated privileges. This issue is due to a buffer overflow error in
the Plug and Play (PnP) service that does not properly validate user
supplied data to the functions "PNP_GetDeviceList" and
"PNP_GetDeviceListSize", which could be exploited by attackers to execute
arbitrary commands.

Note : On Windows 2000 and Windows XP SP1, an authenticated user could
remotely exploit this vulnerability, however, in certain Windows XP
configurations, anonymous users could authenticate and exploit this
vulnerability as the Guest account. On Windows XP SP2, only an administrator
can remotely access the affected component. Therefore, on Windows XP SP2,
this issue is strictly a local privilege elevation vulnerability.

* Affected Products *

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 1
Microsoft Windows XP Service Pack 2

* Solution *

Apply patches :
http://www.microsoft.com/technet/security/Bulletin/MS05-047.mspx

[snip]

http://www.frsirt.com/english/advisories/2005/2044

- ferg


--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet  fergdawg () netzero net or
fergdawg () sbcglobal net  ferg's tech blog: http://fergdawg.blogspot.com/

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.