Microsoft Security Bulletin MS04-011

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

What is the scope of the vulnerability?
This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could remotely take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

What causes the vulnerability?
An unchecked buffer in the LSASS service.

What is LSASS?
Local Security Authority Subsystem Service (LSASS) provides an interface for managing local security, domain authentication, and Active Directory processes. It handles authentication for the client and for the server. It also contains features that are used to support Active Directory utilities.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

Who could exploit the vulnerability?
On Windows 2000 and Windows XP, any anonymous user who could deliver a specially crafted message to the affected system could attempt to exploit this vulnerability.

How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by creating a specially crafted message and sending the message to an affected system, which could then cause the affected system to execute code.

An attacker could also access the affected component through another vector. For example, an attacker could log on to the system interactively or by using another program that passes parameters to the vulnerable component (locally or remotely).

What systems are primarily at risk from the vulnerability?
Windows 2000 and Windows XP are primarily at risk from this vulnerability.

Windows Server 2003 and Windows XP 64-Bit Edition Version 2003 provide additional protection that would require an administrator to log on locally to an affected system to exploit this vulnerability.

What does the update do?
The update removes the vulnerability by modifying the way that LSASS validates the length of a message before it passes the message to the allocated buffer.

This update also removes the vulnerable code from Windows 2000 Professional and from Windows XP because these operating systems do not require the vulnerable interface. This helps protect against possible future vulnerabilities in this service.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

What’s the scope of the vulnerability?

This is a denial of service vulnerability. An attacker who exploited this vulnerability could cause the server to automatically restart and, during that time, stop the server from responding to authentication requests. This vulnerability exists in Windows 2000 Server systems that perform the role of a domain controller. The only effect on other Windows 2000 systems is that clients may not be able to log on to the domain if their domain controller stops responding.

What causes the vulnerability?

The processing of specially crafted LDAP messages by the Local Security Authority Subsystem Service (LSASS).

What is LDAP?

Lightweight Directory Access Protocol (LDAP) is an industry-standard protocol that enables authorized users to query or modify the data in a metadirectory. For example, in Windows 2000, LDAP is one protocol that is used to access data in Active Directory.

What’s wrong with the way the specially crafted LDAP messages are handled?

An attacker could send a specially crafted LDAP message to the LSASS service and cause it to stop responding.

What is LSASS?

Local Security Authority Subsystem Service (LSASS) provides an interface for managing local security, domain authentication, and Active Directory processes. It handles authentication for the client and for the server. It also contains features that are used to support Active Directory utilities.

What might an attacker use the vulnerability to do?

An attacker who exploited this vulnerability could cause LSASS to stop responding and the affected system to restart. The affected system might display a warning that it would automatically restart after a 60-second countdown. During this 60 second countdown, local authentication at the console of the affected system and user domain authentication with the affected system would not be possible. At the end of this 60-second countdown, the affected system would automatically restart. If users cannot perform domain authentication with the affected system, they might not be able to access domain resources. After restart, the affected system would be restored to normal functionality. However, it could be susceptible to a new denial of service attack unless the update is applied.

Who could exploit the vulnerability?

Any anonymous user who could deliver the specially crafted LDAP message to the affected system could exploit this vulnerability.

How could an attacker exploit the vulnerability?

An attacker could exploit this vulnerability by sending a specially crafted LDAP message to the domain controllers in a single forest or multiple forests, potentially causing a denial of service to domain authentication throughout an enterprise. This could cause LSASS to stop responding and cause the affected system to restart. An attacker does not have to have a valid user account in the domain to send this specially crafted LDAP message. This attack can be performed by using anonymous access.

What systems are primarily at risk from the vulnerability?

Only Windows 2000 domain controllers are vulnerable.

I am running Windows 2000. What systems do I have to update?

The update to address this vulnerability must be installed on systems that are used as Windows 2000 domain controllers. However, the update can be safely installed on Windows 2000 Servers in other roles. Microsoft recommends that you install this update on systems that might be promoted to domain controllers in the future.

What does the update do?

The update removes the vulnerability by modifying the way that LSASS processes the specially crafted LDAP message.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server

What’s the scope of the vulnerability?

A buffer overrun vulnerability exists in the Private Communications Transport (PCT) protocol, which is part of the Microsoft Secure Sockets Layer (SSL) library. Only systems that have SSL enabled, and in some cases Windows 2000 domain controllers, are vulnerable.

All programs that use SSL could be affected. Although SSL is generally associated with Internet Information Services by using HTTPS and port 443, any service that implements SSL on an affected platform is likely to be vulnerable. This includes but is not limited to, Microsoft Internet Information Services 4.0, Microsoft Internet Information Services 5.0, Microsoft Internet Information Services 5.1, Microsoft Exchange Server 5.5, Microsoft Exchange Server 2000, Microsoft Exchange Server 2003, Microsoft Analysis Services 2000 (included with SQL Server 2000), and any third-party programs that use PCT. SQL Server 2000 is not vulnerable because it specifically blocks PCT connections.

Windows Server 2003 and Internet Information Services 6.0 are only vulnerable to this issue if an administrator has manually enabled PCT (even if SSL has been enabled).

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

What causes the vulnerability?

The process used by the SSL Library to check message inputs.

What is the SSL library?

The Microsoft Secure Sockets Layer (SSL) library contains support for a number of secure communication protocols. These include Transport Layer Security 1.0 (TLS 1.0), Secure Sockets Layer 3.0 (SSL 3.0), and the older and seldom-used Secure Sockets Layer 2.0 (SSL 2.0), and Private Communication Technology 1.0 (PCT 1.0) protocol.

These protocols provide an encrypted connection between a server and a client system. SSL can help protect information when transmitted across public networks such as the Internet. SSL support requires an SSL certificate, which must be installed on a server. For more information about SSL, see Microsoft Knowledge Base Article 245152.

What is PCT?

Private Communication Technology (PCT) is a protocol developed by Microsoft and Visa International for encrypted communication on the Internet. It was developed as an alternative to SSL 2.0. It is similar to SSL. The message formats are similar enough that a server can interact with clients that support SSL as well as clients that support PCT.

PCT is an earlier protocol that has been replaced by SSL 3.0 and is no longer generally used. The Microsoft Secure Sockets Layer (SSL) library supports PCT only for backward compatibility. Most modern programs and servers use SSL 3.0, and PCT is no longer required. For more detailed information, visit the MSDN Library Web site.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

Who could exploit the vulnerability?

Any anonymous attacker who could deliver a specially crafted TCP message to an SSL enabled service on an affected system could attempt to exploit this vulnerability.

How could an attacker exploit this vulnerability?

An attacker could exploit this vulnerability by communicating with an affected system through an SSL enabled service and sending a specially crafted TCP message. Receipt of such a message could cause the affected service on the vulnerable system to fail in such a way that it could execute code.

An attacker could also access the affected component through another vector. For example, an attacker could log on to the system interactively or by using another program that passes parameters to the vulnerable component (locally or remotely).

What systems are primarily at risk from the vulnerability?

All programs that use SSL could be affected. Although SSL is generally associated with Internet Information Services by using HTTPS and port 443, any service that implements SSL on an affected platform is likely to be vulnerable. This includes but is not limited to, Internet Information Services 4.0, Internet Information Services 5.0, Internet Information Services 5.1, Exchange Server 5.5, Exchange Server 2000, Exchange Server 2003, Analysis Services 2000 (included with SQL Server 2000), and any third-party programs that use PCT. SQL Server 2000 is not vulnerable because it specifically blocks PCT connections.

Windows Server 2003 and Internet Information Services 6.0 are only vulnerable to this issue if an administrator has manually enabled PCT (even if SSL has been enabled).

Active Directory domains that have an Enterprise Root certification authority installed are also affected by this vulnerability because Windows 2000 domain controllers will automatically listen for SSL connections.

How is Windows Server 2003 affected?

The way that Windows Server 2003 implements PCT contains the same buffer overrun that is found on other platforms. However, PCT is disabled by default. If the PCT protocol were enabled by using a registry key, Windows Server 2003 could then be vulnerable to this issue. Microsoft is therefore releasing a security update for Windows Server 2003 that corrects the buffer overrun while continuing to leave PCT disabled.

What does the update do?

The update removes the vulnerability by altering the way that the PCT implementation validates the information passed to it and also disables the PCT protocol.

Does this update introduce any behavioral changes?

Yes. While the update does address the vulnerability in PCT, it also disables PCT because this protocol is no longer used and has been replaced by SSL 3.0. This behavior is consistent with the default settings of Windows Server 2003. If administrators require the use of PCT, they can enable it by using the registry key that is described in the Workaround section of this bulletin.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

What is the scope of the vulnerability?

This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

What causes the vulnerability?

Winlogon reads a value from the domain but does not check the size of this value before inserting it into the allocated buffer.

What is winlogon?

The Windows logon process (Winlogon) is the component of the Windows operating system that provides interactive logon support. Winlogon.exe is the process that manages security-related user interactions in Windows. It handles logon and logoff requests, locking or unlocking the system, changing the password, and other requests. It reads data from the domain during the logon process and uses this data to configure a user’s environment. For more information about Winlogon, visit the MSDN Library Web site.

What is a domain?

A domain can be used to store information about virtually any network object such as printers, file share locations, and personal information. For more information about creating domains using Windows 2000 Server or Windows Server 2003, visit the following Web site.

What could this vulnerability enable an attacker to do?

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

Who could exploit the vulnerability?

An attacker would require permission to modify user objects in a domain to attempt to exploit this vulnerability. Typically, only members of the Administrators or Account Operators groups would have this permission. However, this permission may have been delegated to other user accounts in the domain. User accounts that do not have this permission or anonymous users could not exploit this vulnerability.

How could an attacker exploit this vulnerability?

An attacker could specially modify a value stored in the domain to include malicious data. When this value is passed to an unchecked buffer in Winlogon during the logon process, Winlogon could allow malicious code to be executed.

What systems are primarily at risk from the vulnerability?

Only Windows NT 4.0, Windows 2000, and Windows XP systems that are members of a domain are affected by this vulnerability.

What does the update do?

This update removes the vulnerability by modifying the way the Winlogon process validates the length of a value before passing it to the allocated buffer.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

What is the scope of the vulnerability?

This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

What causes the vulnerability?

An unchecked buffer in the rendering of Windows Metafile (WMF) and Enhanced Metafile (EMF) image formats.

What are Windows Metafile (WMF) and Enhanced Metafile (EMF) image formats?

A WMF image is a 16-bit metafile format that can contain both vector information and bitmap information. It is optimized for the Windows operating system.

An EMF image is a 32-bit format that can contain both vector information and bitmap information. This format is an improvement over the Windows Metafile Format and contains extended features.

For more information about image types and formats, see Microsoft Knowledge Base Article 320314. Additional information about these file formats is also available at the MSDN Library Web Site.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

How could an attacker exploit this vulnerability?

Any program that renders the affected image types could be vulnerable to this attack. Here are some examples:

What systems are primarily at risk from the vulnerability?

The vulnerability could only be exploited on the affected systems by an attacker who persuaded a user to open a specially crafted file or view a directory that contains the specially crafted image. There is no way for an attacker to force a user to open a malicious file.

In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to exploit this vulnerability. An attacker would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's site.

What does the update do?

The update removes the vulnerability by modifying the way that Windows validates the affected image types.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

What is the scope of the vulnerability?

This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could gain complete control over an affected system. An attacker could take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts that have full privileges.

What causes the vulnerability?

The process used by the Help and Support Center to validate data inputs.

What is the Help and Support Center?

Help and Support Center (HSC) is a feature in Windows that provides help on a variety of topics. For example, HSC can teach users about Windows features, how to download and install software updates, how to determine whether a particular hardware device is compatible with Windows, and how to receive help from Microsoft. Users and programs can use URL links to Help and Support Center by using the "hcp://" prefix in a URL link instead of “http://”.

What is the HCP protocol?

Similar to the way that the HTTP protocol can use execute URL links to open a Web browser, the HCP protocol can execute URL links to open the Help and Support Center feature.

What is wrong with the Help and Support Center?

An error in input validation occurs.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

How could an attacker exploit this vulnerability?

To exploit this vulnerability, an attacker would have to host a malicious Web site and then persuade a user to view that Web site. An attacker could also create an HTML e-mail message that has a specially crafted link, and then persuade a user to view the HTML e-mail message and then click the malicious link. If the user clicked this link, an Internet Explorer window could open with an HCP URL of the attacker's choice, which could then allow arbitrary code execution.

What systems are primarily at risk from the vulnerability?

Windows XP and Windows Server 2003 contain the affected version of Help and Support Center. Windows NT 4.0 and Windows 2000 are not affected because they do not contain the Help and Support Center.

I am running Internet Explorer on Windows Server 2003. Does Windows Server 2003 mitigate this vulnerability?

No. By default Internet Explorer on Windows Server 2003 runs in a restricted mode that is known as the Internet Explorer Enhanced Security Configuration. However, the HCP protocol is allowed to access the Help and Support Center by default. Therefore, Windows Server 2003 is vulnerable. For more information about Internet Explorer Enhanced Security Configuration, visit the following Web site.

What does the update do?

This update removes the vulnerability by modifying the validation of data passed to the Help and Support Center.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

What is the scope of the vulnerability?

This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

What causes the vulnerability?

The process used by Utility Manager to launch applications. It is possible that Utility Manager could launch applications with system privileges.

What is Utility Manager?

Utility Manager is an accessibility utility that allows users to check the status of accessibility programs such as Microsoft Magnifier, Narrator, or On-Screen Keyboard, and to start or stop them.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

Who could exploit the vulnerability?

An attacker must be able to log on to the system and then, after starting Utility Manager, run a program that sends a specially crafted message to Utility Manager to attempt to exploit the vulnerability.

How could an attacker exploit this vulnerability?

To exploit this vulnerability, an attacker would first have to start Utility Manager on Windows 2000 and then run a specially designed application that could exploit the vulnerability. In default configurations of Window 2000, Utility Manager is installed but is not running. This vulnerability could allow an attacker to gain complete control over a Windows 2000 system.

What systems are primarily at risk from the vulnerability?

Only Windows 2000 is affected by this vulnerability. Workstations and terminal servers that are based on Windows 2000 are primarily at risk. Servers are only at risk if users who do not have sufficient administrative credentials are given the ability to log on to servers and to run programs. However, best practices strongly discourage allowing this.

I am using Windows 2000, but I am not using Utility Manager or any of the accessibility features. Am I still vulnerable?

Yes. By default, Utility Manager is installed and enabled. However, Utility Manager is not running by default.

Could the vulnerability be exploited over the Internet?

No. An attacker must be able to log on to the specific system targeted for attack. An attacker cannot load and run a program remotely using this vulnerability.

What does the update do?

This update removes the vulnerability by modifying the way that Utility Manager launches applications.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified below.

Delete the affected Windows Management Interface Provider.

An administrator with local administrative permissions can delete the affected Windows Management Interface (WMI) Provider by inserting the following script into a text file that has a ‘.vbs’ file name extension and then running it.

To delete the affected WMI Provider:

set osvc = getobject("winmgmts:root\cimv2")
set otrigger = osvc.get("__win32provider='cmdtriggerconsumer'")
otrigger.delete_

The installation of the update automatically re-registers the affected WMI Provider that is referenced above. You do not have to take any additional steps to restore the system to typical functionality after the update has been applied.

Impact of Workaround: Tasks that are created as event-based triggers will not function while this provider is not registered. For more information about event-based triggers, visit the following Web site.

Note In rare cases, Windows XP could re-register this WMI Provider. For example, if Windows XP detects that the WMI repository has become corrupted, it could try to re-register the affected WMI Provider.

What is the scope of the vulnerability?

This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

What causes the vulnerability?

Under special conditions, a non-privileged user of Microsoft Windows XP could create a task that could execute with system permissions.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

How could an attacker exploit this vulnerability?

To exploit the vulnerability, an attacker must be able to log on to the system and create a task. Because an attacker must have valid logon credentials to exploit the vulnerability, remote systems are not at risk.

What systems are primarily at risk from the vulnerability?

Only Windows XP is affected by this vulnerability.

What does the update do?

The update removes the vulnerability by preventing users from creating tasks at an elevated level of privilege.

Does this update contain any other behavioral changes?

Yes. This update also includes several changes in functionality, documented below:

None.

What is the scope of the vulnerability?

This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

What causes the vulnerability?

The programming interface that is used to create entries in the LDT. These entries contain information about segments of memory. An attacker could create a malicious entry to gain access to protected kernel memory.

What is the Local Descriptor Table?

The Local Descriptor Table (LDT) contains entries called descriptors. These descriptors contain information that defines a particular segment of memory.

What is wrong with the way that a descriptor entry can be created in the LDT?

The programming interface should not allow programs to create descriptor entries in the LDT that point to areas of protected memory.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited the vulnerability could take complete control of the affected system. An attacker could take any action on the system, including installing programs, viewing data, changing data, deleting data, or creating new accounts that have full privileges.

Who could exploit the vulnerability?

An attacker must be able to log on locally to the system and run a program to exploit this vulnerability.

How could an attacker exploit this vulnerability?

To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially designed program that could exploit the vulnerability and potentially gain complete control over the affected system.

What systems are primarily at risk from the vulnerability?

Workstations and terminal servers are primarily at risk. Servers are only at risk if users who do not have sufficient administrative credentials are given the ability to log on and to run programs. However, best practices strongly discourage allowing this.

Could the vulnerability be exploited over the Internet?

No. An attacker must be able to log on to the specific system targeted for attack. An attacker cannot load and run a program remotely using this vulnerability.

What does the update do?

The update removes the vulnerability by modifying the way descriptors entries are created in the LDT.