Sinan Eren
18/10/04, 17:25
http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
We have located the vulnerable function and just recently wrote the
CANVAS module for it but all our tests showed that the NetDDE
vulnerability can not be exploited with a NULL session a.k.a
with "Anonymous Logon" credentials.
Here are some reasons why we think NetDDE rpc interface procedure calls
can only be done after authentication (any local or domain user)
1- \pipe\nddeapi named pipe do not have the "Anonymous Logon" credentials
2- HKLM\SYSTEM\ControlSet001\Services\lanmanserver\pa rameters\NullSessionPipes
do not list the nddeapi pipe in any of the current windows OS installs
3- \pipe\nddeapi is not hardcoded in the srv.sys driver (please check:
http://www.hsc.fr/ressources/articles/win_net_srv/index.html.en#htoc33 )
Please feel free to correct us! We will be delighted to hear that this
vuln is actually a pre-auth ;)
The most puzzling question is why does Microsoft "upplays" this
vulnerabilities severity rather than the usual downplaying efforts ?
I remember a good friend reporting them a remote ring-0 vulnerability
in terminal services which they silently fixed in SP3 and dont even bother
to credit him because they simply believe only remote DOS can be achieved
with a remote kernel overflow!! So does that mean MS changed its policy
regarding vulnerability severity assesment or they have a ongoing love
relation with NGS ? puzzles the mind ;)
cheers,
Sinan Eren
Immunity Research
We have located the vulnerable function and just recently wrote the
CANVAS module for it but all our tests showed that the NetDDE
vulnerability can not be exploited with a NULL session a.k.a
with "Anonymous Logon" credentials.
Here are some reasons why we think NetDDE rpc interface procedure calls
can only be done after authentication (any local or domain user)
1- \pipe\nddeapi named pipe do not have the "Anonymous Logon" credentials
2- HKLM\SYSTEM\ControlSet001\Services\lanmanserver\pa rameters\NullSessionPipes
do not list the nddeapi pipe in any of the current windows OS installs
3- \pipe\nddeapi is not hardcoded in the srv.sys driver (please check:
http://www.hsc.fr/ressources/articles/win_net_srv/index.html.en#htoc33 )
Please feel free to correct us! We will be delighted to hear that this
vuln is actually a pre-auth ;)
The most puzzling question is why does Microsoft "upplays" this
vulnerabilities severity rather than the usual downplaying efforts ?
I remember a good friend reporting them a remote ring-0 vulnerability
in terminal services which they silently fixed in SP3 and dont even bother
to credit him because they simply believe only remote DOS can be achieved
with a remote kernel overflow!! So does that mean MS changed its policy
regarding vulnerability severity assesment or they have a ongoing love
relation with NGS ? puzzles the mind ;)
cheers,
Sinan Eren
Immunity Research