NGSSoftware Insight Security Research Advisory Name: Locator Service Buffer Overflow Vulnerability Systems Affected: Windows 2000/XP/NT Severity: High Risk / Critical Category: Buffer Overrun Vendor URL: http://www.microsoft.com/ Author: David Litchfield (davidat_private) Date: 29th January 2003 Advisory number: #NISR29012003 Tool: http://www.ngssoftware.com/rpclocator.html Description *********** There is a remotely exploitable buffer overflow vulnerability in the Microsoft RPC (Remote Procedure Call) Locator Service on Windows platforms. The RPC Locator Service maintains a list of RPC services and servers on the network. Typically only domain controllers run the Locator service by default and these machines are the most at risk. Details ******* When searching for RPC Services on the network a Windows RPC client will connect to the domain controller over TCP port 139/445 (the SMB ports) and search for services/servers through the "locator" named pipe. An attacker can overflow a stack based buffer in the Locator service process by searching for an overly long string for an entry name to use in looking for binding handles. This problem arises due to an unsafe call to wcscpy(). Fix Information *************** NGSSoftware advised Microsoft to this problem at the end of October of 2002. Microsoft released the patch to resolve this issue last week. http://www.microsoft.com/security/security_bulletins/ms03-001.asp NGSSoftware have written a free command line scanner to locate Microsoft computers running the RPC Locator service on the network. This may be downloaded from the NGSSite. [Please note that this scanner does not test for the actual vulnerability, but rather helps locate those machines most at risk. Although sample exploit code has been provided to the vendor, due to the recent events of last weekend, NGSSoftware are loathe to publish this publicly at this juncture - however we may after a grace period.] http://www.ngssoftware/rpclocator.html A check for this issue is already in Typhon, NGSSoftware's advanced vulnerability assessment scanner, of which more information is available from the NGSSite, http://www.ngssoftware.com. Further Information ******************* For further information about the scope and effects of buffer overflows, please see http://www.ngssoftware.com/papers/non-stack-bo-windows.pdf http://www.ngssoftware.com/papers/ntbufferoverflow.html http://www.ngssoftware.com/papers/bufferoverflowpaper.rtf http://www.ngssoftware.com/papers/unicodebo.pdf About NGSSoftware ***************** NGSSoftware design, research and develop intelligent, advanced application security assessment scanners. Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of Scotland. NGSSoftware's sister company NGSConsulting, offers best of breed security consulting services, specialising in application, host and network security assessments. http://www.ngssoftware.com/ http://www.ngsconsulting.com/ Telephone +44 208 401 0070 Fax +44 208 401 0076 enquiriesat_private
This archive was generated by hypermail 2b30 : Thu Jan 30 2003 - 08:33:11 PST