RE: Windows NT 4.0 with IBM JVM Denial of Service

From: Angelidis, Fotis(NSASOUDABAY) (AngelidisFat_private)
Date: Fri Jul 25 2003 - 02:48:05 PDT

  • Next message: NGSSoftware Insight Security Research: "[VulnWatch] Oracle Extproc Buffer Overflow (#NISR25072003)"

    >Microsoft has issued a bulletin and a patch.  More information
    >is available at:
    
    >http://www.microsoft.com/technet/security/bulletin/MS03-029.asp
    
    
    >Recommendation:
    
    >Java developers should identify all occurances and perform data
    >validation where java.io.getCanonicalPath is used.
    
    >NT 4.0 Administrators running servers which use Java servlets
    >should consider installing the Microsoft supplied patch.
    
    After installing the patch on an NT 4 SP 6a server, we experienced problems
    with the RAS manager. Specifically, while the machine was rebooting after
    the update, the familiar "One or more services ..." window popped up.
    Seconds before we pull up the Event Viewer to examine what went wrong during
    the startup Dr. Watson appeared stating that an exception had happened while
    loading loadqm.exe. The Event viewer, on the other hand, showed us three
    main error messages: 
    Event ID 7001 - Remote Access Autodial Manager,
    Event ID 7023 - Remote Access Connection Manager and 
    Event ID 20067 - Point to Point Protocol failed to initialize. 
    
    Uninstalling the patch didn't help, neither uninstalling/installing the RAS
    service. The only solution which seemed appropriate at the moment was to
    re-install the operating system, which we did.
    
    After installing and setting up the server, we visited windowsupdate.com.
    Since previously the specific patch was installed following the above link,
    we decided to let Windows Update find the available patches for our case
    this time. The patch was included in the recommended updates, so we
    downloaded all the updates, installed and rebooted the machine.
    Unfortunately, the same errors appeared again. The difference this time was
    that after unistalling the specific patch everything was back to normal,
    fortunately :)
    
    Has anybody else experienced any kind of strange behaviour after installing
    this patch ?
    



    This archive was generated by hypermail 2b30 : Fri Jul 25 2003 - 10:51:55 PDT