MICROSOFT WINDOWS — THE HEADLINES

 2001/7/25 

Microsoft Services for Unix 2.0 Telnet and NFS services contain memory leaks

 2001/7/03 

New Exploit for Win9x NETBIOS Password Verification flaw

 2001/6/28 

Issues with Win2k EFS and disk wipe software

 2001/6/27 

LDAP over SSL exposes Win2k password changing function

 2001/6/19 

Win2k permissions problem

MICROSOFT WINDOWS — THE LINKS

• Fport maps open network connections
• PromiScan, a promiscuous mode scanner
• "The Hardening Windows 2000 Guide" by Phil Cox
• Achilles tests the security of web applications

  Disclaimer: These hyper-links can be placed by visitors of this site. The link, the description and the content of the linked pages do not fall under the responsibility of the SYS-2064 editors and do not represent their opinion. The editors may modify or delete any entries.

MICROSOFT WINDOWS — THE NEWS

2001/7/25

12:51 +0100

Microsoft Services for Unix 2.0 Telnet and NFS services contain memory leaks

[Microsoft Windows] Among the components provided by Services for Unix (SFU) 2.0 are services that implement the NFS (Network File System) and Telnet protocols. Both services contain memory leaks that could be triggered by a user request.

An attacker who repeatedly sent such a request could deplete the kernel memory on the server to the point where performance slowed and the system could potentially fail, Microsoft admits, crediting Peter Gründl.

A patch is available to fix this vulnerability. Please read the Microsoft Security Bulletin MS01-039 for information on obtaining this patch. :: [dre].

Comments (0)

2001/7/03

12:53 +0100

New Exploit for Win9x NETBIOS Password Verification flaw

[Microsoft Windows] NS Focus had reported a vulnerability in the password verification scheme utilized by Microsoft Windows 95/98 NETBIOS protocol implementation on 7/9/2000. This vulnerability allowed any user to access the Windows 9x file-shared service with password protection. Potential attackers did not have to know the share password.

Melih Sarica has now provided a new proof-of-concept code that exploits the mentioned vulnerability.

There is also a subsequent vulnerability, that additionally affects Windows Me. Users should check the bug report "Share Level Password Vulnerability" that includes links to the respective patches. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/6/28

12:21 +0100

Issues with Win2k EFS and disk wipe software

[Microsoft Windows] A Colman Communications Security Advice reports the following security vulnerabilities in Windows 2000 with Encrypting File System (EFS) support:
1. Files that are moved into an encrypted folder have a plain text copy made. In addition plain text fragments of the original will also persist.
2. Third party disk wipe products do not effectively "zero" unused disk space under Windows 2000.

When files which were previously in plain text are encrypted using EFS, either by encrypting the file or the directory the file is in, or by moving the file into a directory with EFS applied, a plain-text (as distinct from cipher-text) copy of the file is made on the disk. In addition to this plain text fragments of the original file may also persist. When EFS is used in the recommended manner, e.g. that is files are only created inside folders with EFS enabled, the problem of plain-text copies and fragments does not occur.

The issue described above is compounded by the fact that most third party disk wipe products do not wipe the disks of Windows 2000 systems. This effectively means that users are unable to clear plain text copies of files they thought were encrypted, as well other material they thought they had deleted, by using disk wipe products. Organizations that are making use of disk wipe products to manage risks related to "deleted" data under Windows 2000 should be aware of this issue and act in accordance with this advice:

If you are using EFS then you should ensure that: —Your users are educated on the correct manner of operating EFS so as to prevent the proliferation of plain text copies. —You install and run the cipher.exe tool on your systems to ensure that any plain text copies and other sensitive "deleted" information is zeroed.

The new version of cipher.exe along with install instructions can be found at the related Microsoft Knowledge Base Article: Q298. Additional notes from Colman Communications Consulting on using EFS can be found at: colmancomm.com. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/6/27

13:23 +0100

LDAP over SSL exposes Win2k password changing function

[Microsoft Windows] The LDAP function that is available if the Microsoft Windows 2000 LDAP server has been configured to support LDAP over SSL sessions contains an error that manifests itself when the directory principal is a domain user and the data attribute is the domain password. Then the function fails to check the permissions of the requester, with the result that it could be possible for an attacker to change any other user's domain login password, Microsoft Product Security admits.

An attacker could change another user's password to cause a denial of service by preventing the other user from logging on, or in order to log into the user's account and gain any privileges the user had. Clearly, the most serious case would be one in which the attacker changed a domain administrator's password and logged into the administrator's account.

By design, the function affected can be called by any user who can connect to the LDAP server, including users who connect via anonymous sessions. As a result, any user who could establish a connection with an affected server could exploit the vulnerability.

Win2k users should check MS01-036 for the according patches. :: [dre].

Comments (0)

2001/6/19

15:25 +0100

Win2k permissions problem

[Microsoft Windows] A relayed post from the SecurityFocus "pen-test" list: There is apparently a bug in Windows 2000 Server regarding NTFS permissions. The symptom is that at the individual file level the "Allow Inheritable Permissions" switch and NTFS file permissions can change unexpectedly and without notification. These changes to file security easily go unknown to both network administrators and end users. Microsoft has acknowledged a similar problem referenced in KB article Q266731. Microsoft has created a hot fix for this issue, however in testing the hot fix has not corrected the problem that we have identified.

Example: In the case where a particular file's NTFS permissions are set different from those of its parent folder and the inheritance box on the file has been unchecked, the inherit permissions box on the file can turn itself on and the NTFS file permissions will then change to the permissions defined on the parent folder when the file is modified and saved.

Configurations where the problem has been observed: —Windows 2000 Server SP1 —NT 4.0 SP6a Workstation —Various applications such as: Word 97, Excel 97, Visio 5.0.

The problem seems to manifest itself when using applications that create temp files. As many current software packages do create temp files the network security implications are obvious. While security problems are always serious, this one carries the additional danger of network security being altered against the intention of the administrator, while the administrator is unaware that security changes have taken place. :: [dre].

Comments (0)