AUSCERT External Security Bulletin Redistribution

                 ESB-2002.657 -- CERT Advisory CA-2002-33
               Heap Overflow Vulnerability in Microsoft Data
                             22 November 2002


        AusCERT Security Bulletin Summary

Product:                Microsoft Data Access Components (MDAC)
                        Internet Explorer 6
                        Internet Explorer 5.5
                        Internet Explorer 5.01
Vendor:                 Microsoft
Impact:                 Administrator Compromise
                        Execute Arbitrary Code/Commands
                        Denial of Service
Access Required:        Remote

Ref:                    ESB-2002.652

- --------------------------BEGIN INCLUDED TEXT--------------------


CERT Advisory CA-2002-33 Heap Overflow Vulnerability in Microsoft Data
Access Components (MDAC)

   Original release date: November 21, 2002
   Last revised: --
   Source: CERT/CC

   A complete revision history can be found at the end of this file.

Systems Affected

   All Microsoft Windows systems running the following:
     * Versions of Microsoft Data Access Components (MDAC) prior to 2.7
     * Internet Explorer version 6
     * Internet Explorer version 5.5
     * Internet Explorer version 5.1

   Note that Microsoft Windows XP is shipped with MDAC version 2.7 and is
   not  vulnerable  by  default  even  though  Internet  Explorer  6.0 is

   Because  the  normal operation of several applications and web servers
   on  a  system  depend  on  the  proper  operation  of the MDAC ActiveX
   control,  other  programs  could  be  used  as  an exploit vector. For
   example, Internet Information Server may be configured to use MDAC.


   A  vulnerability  in the Microsoft Data Access Components (MDAC) could
   lead  to  remote  execution of code with the privileges of the current
   process or user.

I. Description

   Microsoft  Data  Access Components (MDAC) is a collection of utilities
   and  routines  to  process  requests  between  databases  and  network
   applications.  A  buffer  overflow  vulnerability exists in the Remote
   Data Services (RDS) component of MDAC.

   The RDS component provides an intermediary step for a client's request
   for  service  from  a  back-end  database that enables the web site to
   apply business logic to the request.

   According  to Microsoft's Security Bulletin MS02-065, a routine in the
   RDS  component,  specifically  the RDS Data Stub function, contains an
   unchecked  buffer.  The  RDS  Data Stub function's purpose is to parse
   incoming  HTTP  requests  and  generate  RDS  commands. This unchecked
   buffer could be exploited to cause a heap overflow.

   There  are  two ways in which this vulnerability can be exploited. The
   first  involves  an  attacker  sending  a  malicious HTTP request to a
   vulnerable  service,  such  as  an  IIS server. If RDS is enabled, the
   attacker  can  execute  arbitrary  code  as the IIS server. RDS is not
   enabled  by  default on Windows 2000 and Windows XP systems. It can be
   disabled  on  other  systems  by  following  the advice in Microsoft's
   security bulletin.

   The  other  way to exploit this vulnerability involves a malicious web
   site  hosting a page that exploits the buffer overflow in the MDAC RDS
   stub  through  a  client  application, such as Internet Explorer. Most
   systems  running  Internet  Explorer  on  operating systems other than
   Windows  XP are vulnerable to this attack. The attacker is able to run
   arbitrary code as the user viewing the malicious web page.

   Both  web  servers  and  client  applications  that  rely  on MDAC are
   affected.  It  is  recommended that all users of Microsoft Windows 98,
   Windows  98 SE, Windows ME, Windows NT 4.0, and Windows 2000 apply the
   patch (Q329414). Windows XP users are not affected since MDAC 2.7, the
   non-vulnerable version, is installed by default.

   Information  about  this vulnerability is discussed in VU#542081. This
   issue is also being referenced as CAN-2002-1142.

II. Impact

   A  remote attacker could execute arbitrary code with the privileges of
   the application that processed the request.

   In the case of a web server or other service, this is likely to be the
   SYSTEM  or  another account with elevated privileges. In the case of a
   client  application,  this  will  be  the account used to view the web

III. Solution

 Apply a patch from your vendor.

   Microsoft  has  released  a  patch  (Q329414)  and a security bulletin
   (MS02-065)  to  address this issue. An end-user version of MS02-065 is
   available at

   According  to  the Microsoft advisory, a scenario exists in by which a
   vulnerable  version  of  the  control may be re-installed on a Windows
   system  even after the patch has been applied. This is due to the fact
   that  the  vulnerable  ActiveX  control is signed by Microsoft and the
   patch does not set the kill bit for the MDAC control.

   This  vulnerability  was  reported in an advisory by Foundstone and in
   MS02-065 by Microsoft.

   Feedback  can  be  sent  to  the  Authors:  Jason  A.  Rafail, Chad R.
   Dougherty, and Cory F. Cohen.

   This document is available from:

CERT/CC Contact Information

   Email: cert@cert.org
          Phone: +1 412-268-7090 (24-hour hotline)
          Fax: +1 412-268-6989
          Postal address:
          CERT Coordination Center
          Software Engineering Institute
          Carnegie Mellon University
          Pittsburgh PA 15213-3890

   CERT/CC   personnel   answer  the  hotline  08:00-17:00  EST(GMT-5)  /
   EDT(GMT-4)  Monday  through  Friday;  they are on call for emergencies
   during other hours, on U.S. holidays, and on weekends.

Using encryption

   We  strongly  urge you to encrypt sensitive information sent by email.
   Our public PGP key is available from

   If  you  prefer  to  use  DES,  please  call the CERT hotline for more

Getting security information

   CERT  publications  and  other security information are available from
   our web site

   To  subscribe  to  the CERT mailing list for advisories and bulletins,
   send  email  to majordomo@cert.org. Please include in the body of your

   subscribe cert-advisory

   *  "CERT"  and  "CERT  Coordination Center" are registered in the U.S.
   Patent and Trademark Office.

   Any  material furnished by Carnegie Mellon University and the Software
   Engineering  Institute  is  furnished  on  an  "as is" basis. Carnegie
   Mellon University makes no warranties of any kind, either expressed or
   implied  as  to  any matter including, but not limited to, warranty of
   fitness  for  a  particular purpose or merchantability, exclusivity or
   results  obtained from use of the material. Carnegie Mellon University
   does  not  make  any warranty of any kind with respect to freedom from
   patent, trademark, or copyright infringement.

   Conditions for use, disclaimers, and sponsorship information

   Copyright 2002 Carnegie Mellon University.

   Revision History
     November 21, 2002: Initial release

Version: PGP 6.5.8


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967