SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Microsoft)  >   Rpc Vendors:   Microsoft
Microsoft Windows Named Pipe NULL Session Bugs in svcctl and eventlog RPC Interfaces Disclose Information to Remote Users
SecurityTracker Alert ID:  1014417
SecurityTracker URL:  http://securitytracker.com/id/1014417
CVE Reference:   CVE-2005-2150   (Links to External Site)
Updated:  Jun 16 2008
Original Entry Date:  Jul 7 2005
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): NT, 2000
Description:   Two vulnerabilities were reported in the Windows NT 4.0 and Windows 2000 RPC implementation in the processing of named pipes for NULL sessions. A remote user can enumerate services running on the target system. A remote user can view certain event logs.

A remote user can invoke the svcctl Microsoft RPC interface to connect to the Service Control Manager and then enumerate installed or running services on the target system. It may also be possible to start or stop Windows services by exploiting this flaw.

A remote user can invoke the eventlog Microsoft RPC interface to connect to the Windows eventlog service and read the Application or System eventlog.

The vendor was notified on January 23, 2004.

Jean-Baptiste Marchand from Herve Schauer Consultants reported this vulnerability.

The original advisory is available at:

http://www.hsc.fr/ressources/presentations/null_sessions/

Impact:   A remote user can determine what services are installed or running on the target system.

A remote user may be able to start or stop services on the target system.

A remote user can read the Application or System eventlog.

Solution:   The vendor has issued a fix for Windows 2000 as part of Update Rollup 1 for Windows 2000 SP4. More information on the rollup is available at:

http://support.microsoft.com/kb/891861

No fix for Windows NT 4.0 was available at the time of this entry.

As a workaround for Windows NT 4.0 (and Windows 2000), you can modify certain Registry entries and configuration options, as described in:

http://support.microsoft.com/kb/842209

Vendor URL:  www.microsoft.com/ (Links to External Site)
Cause:   Authentication error

Message History:   None.


 Source Message Contents

Subject:  NULL sessions vulnerabilities using alternate named pipes



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

	   NULL sessions vulnerabilities using alternate named pipes 


			       http://www.hsc.fr/


- -[ Summary ]-

         Advisory: NULL sessions vulnerabilities using alternate named pipes 
   CVE identifier: CAN-2005-2150
     Release date: 2005/07/07
 Affected systems: Windows NT 4.0, Windows 2000
    Vendor status: Windows 2000 fixes available in URP1 for Windows 2000 SP4
           Author: Jean-Baptiste Marchand <Jean-Baptiste.Marchand@hsc.fr> 
       References: http://www.hsc.fr/ressources/presentations/null_sessions/


- -[ Affected systems ]-

 - Windows NT 4.0
 - Windows 2000 (prior to URP1 for Windows 2000 SP4)

Windows XP and Windows Server 2003 are not directly affected by the
vulnerabilities described in this document.

Still, the alternate named pipes technique also applies to Windows XP and
Windows Server 2003, including Windows XP SP2 and Windows Server 2003 SP1.

- -[ History ]-

 2004/01/23: vulnerability reported to vendor
 
 2004/02/12: vendor announces its intention to release fixes as part of the next
             Windows 2000 Service Pack 

 2004/09/09: a related vulnerability affecting Windows XP SP2 is published 

 2005/02/08: release of MS05-007, fixing a specific instance of a similar
             vulnerability in Windows XP and Windows XP SP2

 2005/02/28: private versions of Windows 2000 fixes available for test

 2005/03/30: confirmation that tested fixes correct the vulnerability

 2005/06/28: release of URP1 for Windows 2000 SP4, which includes fixes for
             Windows 2000
 

- -[ Overview ]-

By taking advantage of hardcoded named pipes allowed for NULL sessions and using
the property of MSRPC that, by default, all available RPC interfaces in a
process can be reached using any opened endpoint, it is possible to:

 - anonymously enumerate Windows services of a remote Windows NT 4.0 or Windows
   2000 system (svcctl vulnerability)

 - anonymously read the Application and System eventlogs of a remote Windows NT
   4.0 or Windows 2000 system (eventlog vulnerability)


- -[ svcctl vulnerability details ]-

The svcctl MSRPC interface is used to communicate with the Windows SCM (Service
Control Manager):

 http://www.hsc.fr/ressources/articles/win_net_srv/ch04s07s09.html

The svcctl vulnerability allows an anonymous user to connect to the SCM (Service
Control Manager). It is then possible to enumerate installed or running
services:

 http://www.hsc.fr/ressources/presentations/null_sessions/img16.html


Depending on the security descriptor protecting each service (stored in binary
under the Security registry subkey of each service's subkey), it might be
possible to anonymously start or even stop a Windows service.

Because in Windows NT 4.0 and Windows 2000, the EVERYONE group contains the
ANONYMOUS LOGON SID, a service with a weak DACL allowing members of the EVERYONE
group to start (or stop) the service can be remotely started or stopped
anonymously. 

For more information about services permissions, see 

 http://cert.uni-stuttgart.de/archive/bugtraq/2004/10/msg00159.html



- -[ eventlog vulnerability details ]-

The eventlog MSRPC interface is used to communicate with the Windows eventlog
service:

 http://www.hsc.fr/ressources/articles/win_net_srv/ch04s07s06.html

The eventlog vulnerability can be used to anonymously read either the
Application or System eventlog of a remote Windows NT 4.0 or Windows 2000
system.

It is not possible to read the Security eventlog because a specific Windows
privilege must be held by the caller process (SeSecurityPrivilege).


- -[ Workaround ]-

Both vulnerabilities are fixed in the URP1 for Windows 2000 SP4 recently
released by the vendor:

 http://support.microsoft.com/kb/900345/


The svcctl vulnerability was fixed by modifying the SCM DACL (enforced when the
OpenSCManager{A,W} operation is used), denying access for the ANONYMOUS LOGON
SID.

The eventlog vulnerability was fixed by using a RPC callback function for the
eventlog interface, to reject unauthenticated binds.


It is also possible to protect against the eventlog vulnerability by adding and
setting to 1 the RestrictGuestAccess registry value, under the following two
registry keys:

 HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\

 HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\System\

In Windows 2000, the RestrictGuestAccess value can be set using the following
security options:

 - Restrict guest access to application log
 - Restrict guest access to system log

These settings are mentionned in the following article:

 http://support.microsoft.com/kb/842209


It is recommended to set these registry values on Windows NT 4.0 systems, where
no other workaround is available.


- -[ Vulnerability assessment ]-

Plugins for the Nessus vulnerability scanner are available to discover
vulnerable hosts:

svcctl vulnerability:

 http://www.nessus.org/plugins/index.php?view=single&id=18585

eventlog vulnerability:

 http://www.nessus.org/plugins/index.php?view=single&id=18602


- -[ References ]-

For more information, see the following documents:

 - MSRPC null sessions: exploitation and protection

  http://www.hsc.fr/ressources/presentations/null_sessions/

 - Windows network services internals

  http://www.hsc.fr/ressources/articles/win_net_srv/


- -[ Credits ]-

These vulnerabilities were discovered by Jean-Baptiste Marchand, with the help


- -[ Copyright ]-

and may be distributed freely provided that no fee is charged for this
distribution and proper credit is given.

- -[ PGP key ]-

 http://www.hsc.fr/~marchand/marchand.asc

 pub   1024D/456EBCD4 2003-02-25
 Key fingerprint = F360 8D66 5AD1 AD17 1941  D14F D0F0 EA74 456E BCD4

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)

iD8DBQFCzOpm0PDqdEVuvNQRAgJPAJ0aK/uD9n/2U8qO8od+sgHmIbuVpgCg1Xgq
rztKIps8npljcawk6PgJzNs=
=97XV
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC