[ISN] Attackers Could Bypass XP SP2 Security Mechanisms

From: InfoSec News (isn@private)
Date: Tue Feb 01 2005 - 01:02:59 PST


http://www.eweek.com/article2/0,1759,1757786,00.asp

By Ryan Naraine 
January 31, 2005 

Microsoft Corp. on Monday confirmed it was investigating a claim by a 
Russian security researcher that two key security technologies built 
into Windows XP Service Pack 2 could be easily defeated.

The weaknesses were highlighted in a research paper [1] published by
Alexander Anisimov of Positive Technologies and centers around XP
SP2's heap protection and DEP (data execution prevention) security
mechanisms.

According to Anisimov, malicious hackers could bypass the two security
mechanisms to execute arbitrary code on Windows systems running XP
SP2. A successful attack could also allow arbitrary memory region
write access (smaller or equal to 1016 bytes) and DEP bypass.

Microsoft is disputing the crux of the researcher's claim, insisting
it is not a security vulnerability.

"An attacker cannot use this method by itself to attempt to run
malicious code on a user's system. There is no attack that utilizes
this, and customers are not at risk from the situation," a
spokesperson for the software giant told eWEEK.com.

She said the two security technologies built into XP SP2 are meant to
make it more difficult for an attacker to run malicious software on
the computer as the result of a buffer overrun vulnerability.

"It's important to note that data execution protection and heap
overflow protection were never meant to be foolproof; the purpose of
these features is to make it more difficult for an attacker to run
malicious software on the computer as the result of a buffer overrun,"  
she said.

Officials at the Microsoft Security Research Center plan to modify the
technologies to address the reported weaknesses.

The primary benefit of DEP is to help prevent code execution from data
pages. In XP SP2 and Microsoft Windows XP Tablet PC Edition 2005, DEP
is enforced by hardware and by software.

Hardware-enforced DEP detects code that is running from these
locations and raises an exception when execution occurs.  
Software-enforced DEP can help prevent malicious code from taking
advantage of exception-handling mechanisms in Windows.

Execution protection, or NX (no execute), prevents code execution from
data pages such as the default heap, various stacks and memory pools.  
Protection can be applied in both user- and kernel mode.

[1] http://www.maxpatrol.com/defeating-xpsp2-heap-protection.htm



_________________________________________
Bellua Cyber Security Asia 2005 -
http://www.bellua.com/bcs2005



This archive was generated by hypermail 2.1.3 : Tue Feb 01 2005 - 02:40:05 PST