Onderwerp: Remote Buffer Overrun WebAdmin.exe

------=_NextPart_000_0AE5_01C33A64.6831CA60
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

NGSSoftware Insight Security Research Advisory

Name: Remote System Buffer Overrun WebAdmin.exe
Systems Affected: Windows
Severity: High Risk
Category: Buffer Overrun
Vendor URL: http://www.altn.com/
Author: Mark Litchfield (mark@ngssoftware.com)
Date: 24th June 2003
Advisory number: #NISR2406-03


Description
***********

WebAdmin allows administrators to securely manage MDaemon, RelayFax, and
WorldClient from anywhere in the world

Details
*******

There is a remotely exploitable buffer overrun in the USER parameter.

By default the webadmin.exe process is started as a system service. Any
code being passed to the server by an attacker as a result of this buffer
overrun would therefore (based on a default install) execute with system
privileges.

POST /WebAdmin.dll?View=Logon HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, */*
Referer: http://ngssoftware.com:1000/
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: MyUser Agent
Host: NGSSoftware.com
Content-Length: 74
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: User=NGSSOFTWARE; Lang=en; Theme=Standard

User=LONGSTRING&Password=foo&languageselect=en&The me=Heavy&Logon=Sign+In

Fix Information
***************

NGSSoftware alerted ALTN to theses issues on the 19th of June 2003.
A patch has now been made available from
ftp://ftp.altn.com/WebAdmin/Release/wa205_en.exe

A check for these issues has been added to Typhon III, of which more
information is available from the
NGSSoftware website, http://www.ngssoftware.com

Further Information
*******************

For further information about the scope and effects of buffer overflows,
please see

http://www.ngssoftware.com/papers/no...bo-windows.pdf
http://www.ngssoftware.com/papers/ntbufferoverflow.html
http://www.ngssoftware.com/papers/bu...rflowpaper.rtf
http://www.ngssoftware.com/papers/unicodebo.pdf
------=_NextPart_000_0AE5_01C33A64.6831CA60--

> NGSSoftware Insight Security Research Advisory
>
> Name: Remote System Buffer Overrun WebAdmin.exe
> Systems Affected: Windows
> Severity: High Risk
> Category: Buffer Overrun
> Vendor URL: http://www.altn.com/
> Author: Mark Litchfield (mark@ngssoftware.com)
> Date: 24th June 2003
> Advisory number: #NISR2406-03

I've been making a few tests using WebAdmin 2.0.3 running under IIS (WebAdmin.dll)

On my tests, I haven't been able to exploit this issue beyond the scope of a Denial of Service. The Active Server Pages
service just reboots itself and two entries are added to the event log:

Application Log:

Event Type: Information
Event Source: Active Server Pages
Event Category: None
Event ID: 3
Date: 24/06/2003
Time: 22:19:16
User: N/A
Computer: XXX
Description:
Service started.



System Log:

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 37
Date: 24/06/2003
Time: 22:17:33
User: N/A
Computer: XXX
Description:
Out of process application '/LM/W3SVC/3/Root/WebAdmin' terminated unexpectedly.
For additional information specific to this message please visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

David A. Pérez