Published:
22 November 2002
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2002.657 -- CERT Advisory CA-2002-33
Heap Overflow Vulnerability in Microsoft Data
22 November 2002
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Microsoft Data Access Components (MDAC)
Internet Explorer 6
Internet Explorer 5.5
Internet Explorer 5.01
Vendor: Microsoft
Impact: Administrator Compromise
Execute Arbitrary Code/Commands
Denial of Service
Access Required: Remote
Ref: ESB-2002.652
ESB-2002.378
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
CERT Advisory CA-2002-33 Heap Overflow Vulnerability in Microsoft Data
Access Components (MDAC)
Original release date: November 21, 2002
Last revised: --
Source: CERT/CC
A complete revision history can be found at the end of this file.
Systems Affected
All Microsoft Windows systems running the following:
* Versions of Microsoft Data Access Components (MDAC) prior to 2.7
* Internet Explorer version 6
* Internet Explorer version 5.5
* Internet Explorer version 5.1
Note that Microsoft Windows XP is shipped with MDAC version 2.7 and is
not vulnerable by default even though Internet Explorer 6.0 is
installed.
Because the normal operation of several applications and web servers
on a system depend on the proper operation of the MDAC ActiveX
control, other programs could be used as an exploit vector. For
example, Internet Information Server may be configured to use MDAC.
Overview
A vulnerability in the Microsoft Data Access Components (MDAC) could
lead to remote execution of code with the privileges of the current
process or user.
I. Description
Microsoft Data Access Components (MDAC) is a collection of utilities
and routines to process requests between databases and network
applications. A buffer overflow vulnerability exists in the Remote
Data Services (RDS) component of MDAC.
The RDS component provides an intermediary step for a client's request
for service from a back-end database that enables the web site to
apply business logic to the request.
According to Microsoft's Security Bulletin MS02-065, a routine in the
RDS component, specifically the RDS Data Stub function, contains an
unchecked buffer. The RDS Data Stub function's purpose is to parse
incoming HTTP requests and generate RDS commands. This unchecked
buffer could be exploited to cause a heap overflow.
There are two ways in which this vulnerability can be exploited. The
first involves an attacker sending a malicious HTTP request to a
vulnerable service, such as an IIS server. If RDS is enabled, the
attacker can execute arbitrary code as the IIS server. RDS is not
enabled by default on Windows 2000 and Windows XP systems. It can be
disabled on other systems by following the advice in Microsoft's
security bulletin.
The other way to exploit this vulnerability involves a malicious web
site hosting a page that exploits the buffer overflow in the MDAC RDS
stub through a client application, such as Internet Explorer. Most
systems running Internet Explorer on operating systems other than
Windows XP are vulnerable to this attack. The attacker is able to run
arbitrary code as the user viewing the malicious web page.
Both web servers and client applications that rely on MDAC are
affected. It is recommended that all users of Microsoft Windows 98,
Windows 98 SE, Windows ME, Windows NT 4.0, and Windows 2000 apply the
patch (Q329414). Windows XP users are not affected since MDAC 2.7, the
non-vulnerable version, is installed by default.
Information about this vulnerability is discussed in VU#542081. This
issue is also being referenced as CAN-2002-1142.
II. Impact
A remote attacker could execute arbitrary code with the privileges of
the application that processed the request.
In the case of a web server or other service, this is likely to be the
SYSTEM or another account with elevated privileges. In the case of a
client application, this will be the account used to view the web
page.
III. Solution
Apply a patch from your vendor.
Microsoft has released a patch (Q329414) and a security bulletin
(MS02-065) to address this issue. An end-user version of MS02-065 is
available at
http://www.microsoft.com/security/security_bulletins/ms02-065.asp.
According to the Microsoft advisory, a scenario exists in by which a
vulnerable version of the control may be re-installed on a Windows
system even after the patch has been applied. This is due to the fact
that the vulnerable ActiveX control is signed by Microsoft and the
patch does not set the kill bit for the MDAC control.
_________________________________________________________________
This vulnerability was reported in an advisory by Foundstone and in
MS02-065 by Microsoft.
_________________________________________________________________
Feedback can be sent to the Authors: Jason A. Rafail, Chad R.
Dougherty, and Cory F. Cohen.
______________________________________________________________________
This document is available from:
http://www.cert.org/advisories/CA-2002-33.html
______________________________________________________________________
CERT/CC Contact Information
Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) /
EDT(GMT-4) Monday through Friday; they are on call for emergencies
during other hours, on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email.
Our public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from
our web site
http://www.cert.org/
To subscribe to the CERT mailing list for advisories and bulletins,
send email to majordomo@cert.org. Please include in the body of your
message
subscribe cert-advisory
* "CERT" and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
______________________________________________________________________
NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software
Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed or
implied as to any matter including, but not limited to, warranty of
fitness for a particular purpose or merchantability, exclusivity or
results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from
patent, trademark, or copyright infringement.
_________________________________________________________________
Conditions for use, disclaimers, and sponsorship information
Copyright 2002 Carnegie Mellon University.
Revision History
November 21, 2002: Initial release
- -----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
iQCVAwUBPd1NYGjtSoHZUTs5AQHUzAQAxi1VWaNhv/9ihPvBWXPU/NmrQxcF3AGx
SCtW1Lsgs7b0LHeNFKwEYxQu7nBGoc4otgQ1oVj+ftrJwOHSA560qPB9Pbu7doSG
7Hql8T/LdOGgcRIAPmLPvAK1rDT2oN85S/adpaQgFRgQw7RYLMsgjCKmQivpCpDA
/8Vb+bI52YU=
=3mho
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/Information/advisories.html
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBPd4KaSh9+71yA2DNAQFBBgP+LwarUecY4g94jlEDjq08JDNN1/7xyVn+
4YQf8l4r4DtBMUm0H5P4zUMm+YNkP5LcT7OWSu8dWwIPsmOsaa09Kq8TFhCekbMU
8S05Rm3G+cyJh2XvXfpd6b3PZElbCq/TJhkQxosqSxQYjA7oLgKBpaBnYxtO3IGv
FYGqQpUPx7w=
=WG9a
-----END PGP SIGNATURE-----