Lucene search

SecurityvulnsSECURITYVULNS:DOC:9088

HistoryJul 07, 2005 - 12:00 a.m.

[Full-disclosure] NULL sessions vulnerabilities using alternate named pipes

2005-07-0700:00:00

vulners.com

JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

       NULL sessions vulnerabilities using alternate named pipes 


              Hervй Schauer Consultants Security Advisory
                           http://www.hsc.fr/

-[ Summary ]-
```
   Advisory: NULL sessions vulnerabilities using alternate named pipes 
```
CVE identifier: CAN-2005-2150
Release date: 2005/07/07
Affected systems: Windows NT 4.0, Windows 2000
Vendor status: Windows 2000 fixes available in URP1 for Windows 2000 SP4
Author: Jean-Baptiste Marchand <[email protected]>
References: http://www.hsc.fr/ressources/presentations/null_sessions/
-[ Affected systems ]-
Windows NT 4.0
Windows 2000 (prior to URP1 for Windows 2000 SP4)

Windows XP and Windows Server 2003 are not directly affected by the
vulnerabilities described in this document.

Still, the alternate named pipes technique also applies to Windows XP and
Windows Server 2003, including Windows XP SP2 and Windows Server 2003 SP1.

-[ History ]-

2004/01/23: vulnerability reported to vendor

2004/02/12: vendor announces its intention to release fixes as part of the next
Windows 2000 Service Pack

2004/09/09: a related vulnerability affecting Windows XP SP2 is published

2005/02/08: release of MS05-007, fixing a specific instance of a similar
vulnerability in Windows XP and Windows XP SP2

2005/02/28: private versions of Windows 2000 fixes available for test

2005/03/30: confirmation that tested fixes correct the vulnerability

2005/06/28: release of URP1 for Windows 2000 SP4, which includes fixes for
Windows 2000

-[ Overview ]-

By taking advantage of hardcoded named pipes allowed for NULL sessions and using
the property of MSRPC that, by default, all available RPC interfaces in a
process can be reached using any opened endpoint, it is possible to:

anonymously enumerate Windows services of a remote Windows NT 4.0 or Windows
2000 system (svcctl vulnerability)
anonymously read the Application and System eventlogs of a remote Windows NT
4.0 or Windows 2000 system (eventlog vulnerability)
-[ svcctl vulnerability details ]-

The svcctl MSRPC interface is used to communicate with the Windows SCM (Service
Control Manager):

http://www.hsc.fr/ressources/articles/win_net_srv/ch04s07s09.html

The svcctl vulnerability allows an anonymous user to connect to the SCM (Service
Control Manager). It is then possible to enumerate installed or running
services:

http://www.hsc.fr/ressources/presentations/null_sessions/img16.html

Depending on the security descriptor protecting each service (stored in binary
under the Security registry subkey of each service's subkey), it might be
possible to anonymously start or even stop a Windows service.

Because in Windows NT 4.0 and Windows 2000, the EVERYONE group contains the
ANONYMOUS LOGON SID, a service with a weak DACL allowing members of the EVERYONE
group to start (or stop) the service can be remotely started or stopped
anonymously.

For more information about services permissions, see

http://cert.uni-stuttgart.de/archive/bugtraq/2004/10/msg00159.html

-[ eventlog vulnerability details ]-

The eventlog MSRPC interface is used to communicate with the Windows eventlog
service:

http://www.hsc.fr/ressources/articles/win_net_srv/ch04s07s06.html

The eventlog vulnerability can be used to anonymously read either the
Application or System eventlog of a remote Windows NT 4.0 or Windows 2000
system.

It is not possible to read the Security eventlog because a specific Windows
privilege must be held by the caller process (SeSecurityPrivilege).

-[ Workaround ]-

Both vulnerabilities are fixed in the URP1 for Windows 2000 SP4 recently
released by the vendor:

http://support.microsoft.com/kb/900345/

The svcctl vulnerability was fixed by modifying the SCM DACL (enforced when the
OpenSCManager{A,W} operation is used), denying access for the ANONYMOUS LOGON
SID.

The eventlog vulnerability was fixed by using a RPC callback function for the
eventlog interface, to reject unauthenticated binds.

It is also possible to protect against the eventlog vulnerability by adding and
setting to 1 the RestrictGuestAccess registry value, under the following two
registry keys:

HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\

HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\System\

In Windows 2000, the RestrictGuestAccess value can be set using the following
security options:

Restrict guest access to application log
Restrict guest access to system log

These settings are mentionned in the following article:

http://support.microsoft.com/kb/842209

It is recommended to set these registry values on Windows NT 4.0 systems, where
no other workaround is available.

-[ Vulnerability assessment ]-

Plugins for the Nessus vulnerability scanner are available to discover
vulnerable hosts:

svcctl vulnerability:

http://www.nessus.org/plugins/index.php?view=single&id=18585

eventlog vulnerability:

http://www.nessus.org/plugins/index.php?view=single&id=18602

-[ References ]-

For more information, see the following documents:

MSRPC null sessions: exploitation and protection

http://www.hsc.fr/ressources/presentations/null_sessions/

Windows network services internals

http://www.hsc.fr/ressources/articles/win_net_srv/

-[ Credits ]-

These vulnerabilities were discovered by Jean-Baptiste Marchand, with the help
of Hervй Schauer Consultants team.

-[ Copyright ]-

The contents of this advisory are copyright (c) 2005 Hervй Schauer Consultants
and may be distributed freely provided that no fee is charged for this
distribution and proper credit is given.