Drei neue Sicherheitslöcher in Windows DCOM RPC

[Fertsch]

Hallo,

heute morgen hatte folgende Sicherheitswarnung vom "WatchGuard LiveSecurity" in meinem Postfach:

All Versions of Windows Still Suffer from DCOM RPC Vulnerabilities

Severity: High

10 September 2003

Summary:

Today, Microsoft released a security bulletin describing three new DCOM RPC security flaws affecting most versions of Windows. The flaws consist of two buffer overflows and one Denial of Service vulnerability. An attacker could exploit the worst of the flaws to gain complete control of your Windows machines. There is no direct impact on WatchGuard products. Windows administrators should download, test, and deploy the appropriate patches immediately.

Exposure:

Remote Procedure Call (RPC) is a protocol Microsoft Windows uses to allow one computer on a network to execute a task on another computer and receive back the results of that task.

Microsoft's Security Bulletin 03-039 (http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp) describes three security vulnerabilities in the DCOM RPC service that ships with Windows NT 4.0, 2000, XP, and 2003. The three flaws (two buffer overflows and one Denial of Service (DoS) vulnerability) stem from the improper handling of intentionally malformed RPC requests.

By sending a Windows machine a specially crafted RPC request, an attacker could exploit the DoS vulnerability to crash the RPC services, preventing other computers from communicating with the victim using this protocol. Worse yet, an attacker exploiting either buffer overflow flaw could gain complete control of your Windows machines!

Note: the buffer overflow vulnerabilities are very similar to the vulnerability in our July 16 alert. The recent and damaging Blaster worm exploited that particular vulnerability to infect its victims and spread all over the world. If proof of concept code is released demonstrating these new DCOM RPC flaws, virus authors may exploit these new RPC flaws to write the next Blaster worm. You should patch immediately.

Solution Path:

Microsoft has released patches to fix these vulnerabilities. Windows administrators should download, test, and deploy the corresponding patches immediately.

Windows NT Workstation

http://www.microsoft.com/downloads/details.aspx?FamilyId=7EABAD74-9CA9-48F4-8DB5CF8C188879DA&displaylang=en

Windows NT Server 4.0

http://www.microsoft.com/downloads/details.aspx?FamilyId=71B6135C-F957-4702-B376-2DACCE773DC0&displaylang=en

Windows NT Server 4.0, Terminal Server Edition

http://www.microsoft.com/downloads/details.aspx?FamilyId=677229F8-FBBF-4FF4-A2E9-506D17BB883F&displaylang=en

Windows 2000

http://www.microsoft.com/downloads/details.aspx?FamilyId=F4F66D56-E7CE-44C3-8B94-817EA8485DD1&displaylang=en

Windows XP

http://www.microsoft.com/downloads/details.aspx?FamilyId=5FA055AE-A1BA-4D4A-B424-95D32CFC8CBA&displaylang=en

Windows XP 64 bit Edition

http://www.microsoft.com/downloads/details.aspx?FamilyId=50E4FB51-4E15-4A34-9DC3-7053EC206D65&displaylang=en

Windows XP 64 bit Edition Version 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=80AB25B3-E387-441F-9B6D-84106F66059B&displaylang=en

Windows Server 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=51184D09-4F7E-4F7B-87A4-C208E9BA4787&displaylang=en

Windows Server 2003 64 bit Edition

http://www.microsoft.com/downloads/details.aspx?FamilyId=80AB25B3-E387-441F-9B6D-84106F66059B&displaylang=en

Diese Löcher im RPC-Dienst sollte man nicht unterschätzen. Ich glaube, daß der Blaster/LovSun-Wurm dies deutlich genug gezeigt hat. Also PAtches runterladen, installieren und dann mal abwarten wann der nächste Wurm kommt

Fertsch

[hades]

Diese Meldung steht auch auf anderen Newslettern und auch auf www.heisec.de .

[Fertsch]

Sicher wird diese Meldung auch woanders stehen, aber wenn ich mir mal die Threads zum Blaster-Wurm ansehe, finde ich es besser, lieber einmal öfters zu warnen. Viele User scheinen ja immer noch völlig ahnungslos und ohne Schutzmaßnahmen ins Inet zu gehen.

Fertsch

[Fertsch]

Habe gerade gemerkt, daß der link für den Patch für WinNT Workstation ins Leere führt, hier ist der richtige:

http://www.microsoft.com/downloads/details.aspx?FamilyId=7EABAD74-9CA9-48F4-8DB5-CF8C188879DA&displaylang=en