SecurityFocus Microsoft Newsletter #85

John Boletta <[email protected]> Tue, 7 May 2002 13:13:31 -0600 (MDT)

Newsgroups	gmane.comp.security.news.microsoft
Message-ID	<[email protected]>

SecurityFocus Microsoft Newsletter #85
--------------------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. VBA Emulation: A Viable Method of Macro Virus Detection? Part Two
2. No Stone Unturned, Part Three
II. MICROSOFT VULNERABILITY SUMMARY
1. Microsoft Baseline Security Analyzer Plaintext Result File...
2. PHPProjekt Login Bypass Vulnerability
3. PHPProjekt SQL Injection Vulnerability
4. Ultimate PHP Board Encrypted Password Disclosure Vulnerability
5. Ultimate PHP Board Image Tag Script Injection Vulnerability
6. Nullsoft Winamp Minibrowser ID3v2 Buffer Overflow Vulnerability
7. AutoLog IP Spoofing Vulnerability
8. Netscape/Mozilla IRC Buffer Overflow Vulnerability
9. Netscape/Mozilla/Galeon Local File Detection Vulnerability
10. BEA Systems WebLogic Server URL Parsing Path Disclosure
11. BEA Systems WebLogic Server Null Character DOS Device Denial...
12. Microsoft Internet Explorer/Outlook Express XBM Handling DoS...
13. PHPProjekt File Read Vulnerability
14. PHPProjekt Unauthorized Script Access Vulnerability
15. Ultimate PHP Board Private Message Disclosure Vulnerability
16. BEA Systems WebLogic Server URL Parsing Source Code Disclosure
17. MyGuestbook Script Injection Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
1. 'rooted' NT/2K boxen? (Thread)
2. Rolling out patches (Thread)
3. Strange behavior after removing Klez on Win2000 server (Thread)
4. Windows Systems Defaced (Thread)
5. Access is denied: driver signing responsible (Thread)
6. Access is denied (Thread)
7. Rolling out patches (Thread)
8. Microsoft Win2k VPN server placement (Thread)
9. Microsoft Win2k VPN server placement (Thread)
10. Windows XP Professional Account Lockouts (Thread)
11. Remote perf counter access (Thread)
12. Bypassing Windows 2000 Domain Password settings (Thread)
13. Admin Preparation for .NET (Thread)
14. PDC -> Workstation Registry Connect (Thread)
15. PDC -> Workstation Registry Connect (Thread)
16. Windows XP Professional Account Lockouts (Thread)
17. SecurityFocus Microsoft Newsletter #84 (Thread)
18. Account Permissions (Thread)
19. Account Permissions (Thread)
20. Remote perf counter access (Thread)
21. NTFS Alternate Data Streams (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. VFind Security Toolkit
2. VPN Client
3. EventReader
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. Mailscanner for Postfix v0.0.6pl1
2. File::Scan v0.24
3. DreamSys Server Monitor v3.1
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. VBA Emulation: A Viable Method of Macro Virus Detection? Part Two
By Gabor Szappanos

This is the second of two articles discussing emulation as a viable method
of virus detection. In this article, we will discuss code execution flow,
underlying operating system problems, and incompatibility issues with
incompatibility in different versions of Office, as well as VBA emulator
environment.

http://online.securityfocus.com/infocus/1576

2. No Stone Unturned, Part Three
by H. Carvey

This is the third installment of a five-part series describing the
(mis)adventures of a sysadmin named Eliot and his haphazard journey in
discovering The Way of Incident Response. As we left off last time,
Eliot had just begun compiling a list of tools that would be helpful in
incident investigation when he was interrupted by a call from Dave, a sys
admin with a branch office on the West Coast. Dave had asked for Eliot's
assistance with an apparent incident. Now, having begun an investigation,
Eliot was baffled and had asked Dave for some clarifying information.

http://online.securityfocus.com/infocus/1574

II. BUGTRAQ SUMMARY
-------------------
1. Microsoft Baseline Security Analyzer Plaintext Result File Vulnerability
BugTraq ID: 4594
Remote: No
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4594
Summary:

Microsoft Baseline Security Analyzer (MBSA) is a tool which scans a
Microsoft Windows system and creates a security report including a variety
of information about the target system.

A weakness has been reported in some versions of this product. The results
are stored in an XML file in a known location. A local attacker may be
able to read this file and gain sensitive information about the system.
XML is a plain text format, offering no real protection against this
threat. The file is stored in the following location:

C:\Documents and Settings\username\SecurityScans

Information stored in this file includes system patch levels, some
security settings, enabled services, account names and information on
which accounts have blank or weak passwords.

There have been reports that much of this information is available to
local attackers through other mechanisms.

This issue may be aggravated by the fact that there are several known ways
to access local files remotely, including through the download and
execution of web page components such as Applets, ActiveX controls, or
ActiveScript code running in an unsafe context.

Reportedly, it is not possible to change the location this file is saved
in through MBSA configuration.

2. PHPProjekt Login Bypass Vulnerability
BugTraq ID: 4596
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4596
Summary:

PHPProjekt is a freely available, open source PHP Groupware package. It is
actively maintained by the PHPProjekt Development Team. It will run on
most Linux and Unix variants, in addition to Microsoft Windows operating
systems.

Some of the PHPProjekt scripts are only intended to be accessed by users
who have been authenticated. However, it has been reported that it is
possible for an unauthenticated attacker to access these scripts via a
specially crafted web request.

To validate that an authenticated user is accessing a script, the
$PHP_SELF variable is checked for the presence of certain strings(such as
'sms'). The $PHP_SELF variable is derived from the PATH_INFO variable.
It is trivial for an attacker to craft a web request which contains the
strings that PHPProjekt is looking for. This will enable the attacker to
access the PHPProjekt scripts that ordinarily may only be accessed by an
authenticated user.

3. PHPProjekt SQL Injection Vulnerability
BugTraq ID: 4598
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4598
Summary:

PHPProjekt does not properly sanitize user-supplied data before it is
passed into SQL queries. This occurs in a number of places throughout
PHPProjekt. This makes it possible for attackers to launch SQL injection
attacks. For example, an attacker may be able to modify the logic of an
existing SQL query.

Exploitation of this issue may cause sensitive information contained in
the database to be disclosed. The attacker may also potentially modify
data. It is also possible that this issue may be leveraged to exploit
existing vulnerabilities in the underlying database.

4. Ultimate PHP Board Encrypted Password Disclosure Vulnerability
BugTraq ID: 4602
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4602
Summary:

Ultimate PHP Board (UPB) is web forum software. It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

Encrypted UPB user passwords are included in files which may be accessible
to a malicious user. Encrypted user passwords are stored by UPB under the
user ID of each registered member. The user files have an extension of
".xbb". A malicious user may make a web request for the file containing
the encrypted password of a particular user.

The malicious user may construct a cookie using the encrypted password of
a registered UPB user and gain access to their account. UPB cookie data
is constructed using the following format:

ID + 'þ' + 'Xb' + 'encrypted user password'

For example, the cookie data for user ID 5 with an encrypted password of
'OhJmLwt' would be:

'5þXbOhJmLwt'

5. Ultimate PHP Board Image Tag Script Injection Vulnerability
BugTraq ID: 4603
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4603
Summary:

Ultimate PHP Board (UPB) is web forum software. It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

Ultimate PHP Board including a feature called UPB-Code, which allows users
to control the format of their messages using special formatting tags.
The [IMG] tag allows users to embed images inside of forum messages.

UPB does not filter HTML from image tags. This may allow an attacker to
inject arbitrary script code in forum messages. Injected script code will
be executed in the browser of an arbitrary web user who views the
malicious forum message, in the context of the website running UPB.

This may be potentially be exploited to hijack web content or steal
cookie-based authentication credentials from legitimate users.

It may be possible to inject script code into other UPB-Code formatting
tags, though this has not been confirmed.

6. Nullsoft Winamp Minibrowser ID3v2 Buffer Overflow Vulnerability
BugTraq ID: 4609
Remote: Yes
Date Published: Apr 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4609
Summary:

Nullsoft Winamp is a media player for Microsoft Windows supporting MP3 and
other filetypes.

ID3v2 is a tagging system that enables users to include relevant
information about audio files within them.

Versions of Winamp are vulnerable to a stack overflow triggered during the
processing of ID3v2 tags.

If a user modifies the title field of the ID3v2 tag with arbitrary
characters, when parsed by Winamp, the overflow occurs.

This has only been reported to occur when the minibrowser is enabled. By
design, the player will prepare to connect to the Winamp site, in order to
gather additional information on the media file. Winamp constructs a URL
containing the data from the file's ID3v2 tag, once the URL is created,
the extraneous data in the title field will overflow the affected buffer.

This overflow could overwrite stack variables, including the return
address, and be used to execute arbitrary code. However, including random
data could cause the application to crash.

It should be noted that this was tested on version 2.79, previous versions
may also be affected by this issue.

7. AutoLog IP Spoofing Vulnerability
BugTraq ID: 4627
Remote: Yes
Date Published: Apr 29 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4627
Summary:

AutoLog is website usage tracking software. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

AutoLog uses cookies to track which users have visited the website it is
running on.

By sending a specially crafted cookie containing an arbitrary IP address,
a remote attacker may cause a false IP to be logged by the script.

An attacker may exploit this issue to conceal the source of malicious web
activity.

8. Netscape/Mozilla IRC Buffer Overflow Vulnerability
BugTraq ID: 4637
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4637
Summary:

Mozilla is a freely available, open-source web browser. It runs on most
Linux and Unix variants, as well as MacOS and Microsoft Windows
9x/ME/NT/2000/XP operating systems. Netscape is another web-browser
product which runs on the same platforms as Mozilla.

Netscape and Mozilla crash when handling an exceptionally long request
(32KB+) for a channel using the IRC protocol.

An attacker may exploit this issue to crash a web user's browser. This is
most likely to occur via a hyperlink in a malicious webpage, but may also
occur via HTML e-mail.

This issue is most likely due to a buffer overflow condition, but it is
not known whether this condition may be exploited to execute arbitrary
attacker-supplied instructions.

Other browsers based on the Mozilla codebase (such as Galeon) may also be
affected by this issue.

9. Netscape/Mozilla/Galeon Local File Detection Vulnerability
BugTraq ID: 4640
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4640
Summary:

Mozilla is a freely available, open-source web browser. It runs on most
Linux and Unix variants, as well as MacOS and Microsoft Windows
9x/ME/NT/2000/XP operating systems. Netscape is another popular
web-browser product which runs on the same platforms as Mozilla. The
Galeon browser is available for various Linux distributions.

External Cascading Style-Sheets (CSS) may be embedded inside of HTML
files. This is accomplished using the <LINK> element. The security model
of the web client is designed to prevent links to other file types and
links to local files on the client's system from remote pages.

It has been demonstrated that it is possible for a webpage to circumvent
this security model by linking to the external file and causing a HTTP
redirect to occur. This could be exploited to detect the existence of a
file on the local system of the web client viewing the malicious page.

This could lead to a disclosure of sensitive information to remote
attackers.

10. BEA Systems WebLogic Server URL Parsing Path Disclosure Vulnerability
BugTraq ID: 4643
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4643
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

It is possible to cause the server to disclose sensitive path information.
This is due to difficulties parsing certain types of malformed requests,
such as those containing null characters (%00).

Various types of malformed web requests will cause the server to display
an error page containing the absolute path to the webroot directory. For
example, this may be accomplished by appending a '%00.jsp' string to the
end of a request for a HTML file. This condition may also occur if the
attacker prepends an encoded backslash (%5c) to the beginning of the
filename for a HTML file. Other types of malformed web requests may also
cause this condition to occur.

Path information may aid the attacker in making further attacks against
the host.

11. BEA Systems WebLogic Server Null Character DOS Device Denial of Service Vulnerability
BugTraq ID: 4646
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4646
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

It is possible to create a denial of service condition by appending a null
character to a web request for MS-DOS device name (such as AUX). Each
such malformed request will cause the connection to hang. After a number
of these requests, the server will not be able to accept any more
connections, as only so many threads can be processed at once.

This condition is in part due to difficulties parsing requests that
contain NULL characters, but is also caused by poor handling of requests
for MS-DOS devices. BugTraq ID 3816 "BEA Systems WebLogic Server DOS
Device Denial of Service Vulnerability" describes a similar condition,
which was fixed in WebLogic Server 6.1 SP2. However, the null character
variation of this attack affects systems running WebLogic Server 6.1 SP2.
Other versions may also be affected.

The server must be restarted to regain normal functionality.

12. Microsoft Internet Explorer/Outlook Express XBM Handling DoS Vulnerability
BugTraq ID: 4653
Remote: Yes
Date Published: May 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4653
Summary:

Microsoft Internet Explorer/Outlook Express 6 include support for XBM
image files. XBM (X Bitmap) is an image format which is represented as
ASCII data, as opposed to binary data.

Microsoft Internet Explorer and Outlook Express crash when handling
malformed XBM image files in webpages, HTML e-mail, or as an e-mail
attachment. This is believed to be the result of insufficient checking of
the content in XBM files. MSIE allocates memory to store the image based
(partly) on the width and height specified. It may be possible for
attackers to specify excessive values, resulting in exhaustion of system
memory or access violation errors.

Other software which relies upon Internet Explorer may also crash when
handling malformed XBM files.

13. PHPProjekt File Read Vulnerability
BugTraq ID: 4597
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4597
Summary:

It has been reported that an attacker may trick the PHPProjekt upload
functions into reading local files on the host running the vulnerable
software.

PHPProjekt does not validate that the variables associated with the upload
functions were set by a file upload. It is possible for an attacker to
set arbitrary values for the upload related variables using normal POST
data.

This may be exploited by the attacker to display the contents of arbitrary
web-readable files.

14. PHPProjekt Unauthorized Script Access Vulnerability
BugTraq ID: 4599
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4599
Summary:

Some of the PHPProjekt scripts are only intended to be accessed by users
who have been authenticated. Attackers may submit data using the HTTP
POST method to view or edit data contained in scripts that normally
require authentication to be accessed. Data submitted in this manner must
be properly formatted.

This is due to insufficient validation of the source of data that is
submitted to PHPProjekt.

15. Ultimate PHP Board Private Message Disclosure Vulnerability
BugTraq ID: 4600
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4600
Summary:

Ultimate PHP Board (UPB) is web forum software. It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

UPB includes a private messaging system. Private messages are stored by
UPB under the user ID of each registered member. Private message files
have an extension of ".pm". UPB does not sufficiently validate which user
is attempting to access a given private message file. As a result,
malicious users may request the private message file of a particular user
and read that user's private messages.

Information gathered in this manner may aid the attacker in making social
engineering attacks against UPB users.

16. BEA Systems WebLogic Server URL Parsing Source Code Disclosure Vulnerability
BugTraq ID: 4645
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4645
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

It is possible to cause the server to disclose JSP script source code.
This is due to difficulties parsing certain types of malformed requests,
such as those containing null characters (%00).

Disclosure of script source code may aid allow the attacker to probe for
other vulnerabilities or may disclose sensitive information such as
database credentials.

Various types of malformed web requests will cause the server to disclose
JSP script source code. For example, this may be accomplished by
appending a '%00x' to a request for an existing JSP script. An attacker
could also append a '+.' string to the end of a request to disclose script
source code. Other types of malformed web requests may also cause this
condition to occur.

17. MyGuestbook Script Injection Vulnerability
BugTraq ID: 4651
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4651
Summary:

MyGuestbook is freely available guestbook software. It will run on most
Unix and Linux variants, as well as Microsoft Windows operating systems.

MyGuestbook does not adequately filter HTML tags from various fields.
This may enable an attacker to inject arbitrary script code into pages
that are generated by the guestbook.

The attacker's script code may be executed in the web client of arbitrary
users who view the pages generated by the guestbook, in the security
context of the website running the software.

Attackers may potentially exploit this issue to hijack web content or to
steal cookie-based authentication credentials.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. 'rooted' NT/2K boxen? (Thread)
Relevant URL: