Slashdot Mirror
Windows Vulnerabilities Revealed, Patched
Saint Aardvark writes "A big MS Windows remote vulnerability has just hit BugTraq. It concerns a buffer overflow in MS' DCOM, and affects Win2k through Server 2003; here's the security advisory from Microsoft. This is in addition to an earlier vulnerability concerning conversion from HTML to RTF - there's a separate security advisory from Microsoft for this one, and it affects Win98 and NT 4.0 through Server 2003. Patch early, patch often." There's also a CNET News story with a little more explanation on the newest vulnerability.
More info here, here and here. Here internetnews.com state that 3 vulnerabilities (not 2) where patched.
Here is the report from the people who found the vulnerabilities (or at least one of them) which includes a proof-of-concept paper and code.
Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your ass tomorrow.
That's from here btw.
The guys that found this vulnerability have an amusing web site. It looks rather professional for the underground (?) community. I bet the wear white coats while they hack.
Article
Sent: Tuesday, January 15, 2002 5:22 PM
To: Microsoft and Subsidiaries: All FTE
Subject: Trustworthy computing
They are right to attribute such great importance to trustworthy systems -- and I do believe they are trying -- but 30,000,000 lines of code necessarily lead to opaque semantics. Good luck, MS, I think this will be one of many such deficiencies in Server 2003. Repeated claims of security and "trustworthiness" from their higher-ups will place the company in a boy-who-cried-wolf marketing scenario; at that point they're up a creek.
Creating brand new bugs with every "stable" Linux kernel release! Anyone even LOOK at the issues lists for releases or pay attention to the kernel mailing list? If the contents of those "documents" were made public, Linux would lose every corperate/government contract they had! The file system/hardware/security bugs that get INTRODUCED as well as patched with each version is frightening.
This article is so completely pot/kettle/black that most regulars here should be getting pretty tired of it by now.
Let me give you a hint: the "bad guy database" isn't connected to the outside world. The only way to get at that (whatever you were referring to) is to have an account on that network, and the right passes and codes to get into the building where it's stored. That's standard operating procedure for many, many secure systems, and I'm sure the US gov isn't any different :).
weird, I just patched this very bug for NT4 from Windows Update. YMMV, I guess.
======================================
Writers get in shape by pumping irony.
The point is this is a remotely exploitable system level hole.
It's important to note that the system account is god in Windows -- even Administrator has less power than system.
Could not check the MS one but I am guessing more than 3 of them were OS level patches since there were three just today.
I don't see how, they all releated to subsystems outside of the kernel.
This patch that was released - well, I installed it on my home machines today. It screwed up my OpenGL libraries. Considering it should have absolutely nothing to do with OpenGL, microsofts patches are making me EXTREMELY nervous.
.
Saying Apache doesn't count, but IIS does is not comparing correctly. One reason MS appears to have so many more bugs is that their OS includes a lot more components that are thought of as part of the OS.
Actually it is comparing correctly because of the way the different systems are architected.
Apache is usually run in userland with limited privledges on a Unix machine while IIS.sys is a kernel mode device driver on a Windows machine. There result is a compromise in IIS presents a system wide security issue while a similar security issue in Apache only represents a user level security issue.
This sort of thing is very common in comparing Windows vs Unix/Linux security. The Windows code runs with admin level access or as part of the kernel, while the Linux application runs with much more restricted access.
That's not true. Most Open Source projects maintain private channels for security issues and don't disclose the bug until it's fixed. This includes Linux-Kernel, Apache, Mozilla, and so on.
I checked my incoming logs and am already seeing quite a few more tickles at port 135 than usual. Where from, you ask? Somewhere in china mostly.. ips in the range 218.15.192.xxx coming from somewhere beyond blahblah.gd.cn.net. Here's one of the ips (its a phony drug sales place) 218.15.192.84... nice little e-com site :)
Ugh, isn't the net fun?
StrategyTalk.com, PC Game Forums
I've been seeing overflows run against port 135 on my home network for awhile now. Typically, these requests seem to come from Korea. Fortunately, my pc never had that port open anyway, and port 135 is Samba on my mac, but that is not effected by this exploit, though linux had a samba BO exploit a couple months back as I recall.
So, it may be very possible this sploit has been around for some time now.
C2 for NT was achieved on a machine minus CD drive and NIC card. (bet that's a machine we all want)
C2 is no longer used by the govt. It's been replaced by something called Common Criteria which Red Hat has obtained.