RE: Now Showing: MS05-047 Exploit In-The-Wild

[Jordan Wiens <numatrix () ufl edu>]

Oh, believe me, it is fun.  It's Friday afternoon, I'm going on a week 
vacation now, and everybody else in my office gets to deal with it.

If that's not 'funsec', it's gotta at least 'funnysec', or maybe 
'ironicsec'.  ;-)

Aww, nevermind.  Joe just ruined all the fun.  No huge threat.  *sigh*

The running joke between my boss and me is that whenever one of us goes on 
vacation, it's pretty much guaranteed to signify some new vulnerability, 
exploit, worm, or other bit of fun.  We of course always blame the other 
person on unleashing whatever it was to keep the poor sap staying behind 
from being bored.

--
Jordan Wiens, CISSP
UF Network Security Engineer
(352)392-2061

On Fri, 21 Oct 2005, Larry Seltzer wrote:

> What the hell's with all this on-topic stuff? I though this was a "fun" list
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blog.ziffdavis.com/seltzer
> Contributing Editor, PC Magazine
> larryseltzer () ziffdavis com
>
> -----Original Message-----
> From: funsec-bounces () linuxbox org [mailto:funsec-bounces () linuxbox org] On
> Behalf Of Fergie (Paul Ferguson)
> Sent: Friday, October 21, 2005 12:56 PM
> To: funsec () linuxbox org
> Subject: [funsec] Now Showing: MS05-047 Exploit In-The-Wild
>
> That's right. You should've been patched, like, yesterday.
>
> Personally, I expect to see a worm which uses this exploit to begin
> circulating within the next few days.
>
> Via FrSIRT.
>
> [snip]
>
> Microsoft Windows Plug and Play "Umpnpmgr.dll" Remote Exploit (MS05-047)
>
> Exploits this advisory:
>
> Advisory ID : FrSIRT/ADV-2005-2044
> CVE ID : CVE-2005-2120
> Rated as : High Risk
> Remotely Exploitable : Yes
> Locally Exploitable : Yes
> Release Date : 2005-10-11
>
> * Technical Description *
>
> A vulnerability has been identified in Microsoft Windows, which may be
> exploited by attackers to execute abitrary commands or by malicious users to
> obtain elevated privileges. This issue is due to a buffer overflow error in
> the Plug and Play (PnP) service that does not properly validate user
> supplied data to the functions "PNP_GetDeviceList" and
> "PNP_GetDeviceListSize", which could be exploited by attackers to execute
> arbitrary commands.
>
> Note : On Windows 2000 and Windows XP SP1, an authenticated user could
> remotely exploit this vulnerability, however, in certain Windows XP
> configurations, anonymous users could authenticate and exploit this
> vulnerability as the Guest account. On Windows XP SP2, only an administrator
> can remotely access the affected component. Therefore, on Windows XP SP2,
> this issue is strictly a local privilege elevation vulnerability.
>
> * Affected Products *
>
> Microsoft Windows 2000 Service Pack 4
> Microsoft Windows XP Service Pack 1
> Microsoft Windows XP Service Pack 2
>
> * Solution *
>
> Apply patches :
> http://www.microsoft.com/technet/security/Bulletin/MS05-047.mspx
>
> [snip]
>
> http://www.frsirt.com/english/advisories/2005/2044
>
> - ferg
>
>
> --
> "Fergie", a.k.a. Paul Ferguson
> Engineering Architecture for the Internet  fergdawg () netzero net or
> fergdawg () sbcglobal net  ferg's tech blog: http://fergdawg.blogspot.com/
>
> _______________________________________________
> Fun and Misc security discussion for OT posts.
> https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
> Note: funsec is a public and open mailing list.
>
>
> _______________________________________________
> Fun and Misc security discussion for OT posts.
> https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
> Note: funsec is a public and open mailing list.
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.