Onderwerp: First vulnerabilities in the SP2 - XP ?...

http://www.heise.de/security/artikel/50051

Regards,
Jérôme ATHIAS

This is a MIME encapsulated multipart message -
please use a MIME-compliant e-mail program to open it.

Dies ist eine mehrteilige Nachricht im MIME-Format -
bitte verwenden Sie zum Lesen ein MIME-konformes Mailprogramm.

--========GMXBoundary114231092760192
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi,

> http://www.heise.de/security/artikel/50051
I also read this yesterday (the German version) and I think it's not a
vulnerability. It's IMO a misconception in the way how SP2 treats alien
executables. And on the other hand it does not actually lower the value of
SP2 concerning security - because the rest of SP2 already boosted security
(this time despite compatibility issues - thanks to MS for finally skipping
compatibility in favor of security). But I agree with the author that MS
should fix this anyway!

Can someone please check if ShellExecute()/ShellExecuteEx() behave different
from the CreateProcess-functions *)? Could that be the reason?
Where is the information stored, that a file was downloaded - ADS? - EAs?
.... some arcane new feature?

Oliver

*) CreateProcess, CreateProcessAsUser, CreateProcessWithLogonW,
CreateProcessWithTokenW

--
---------------------------------------------------
May the source be with you, stranger ...
--========GMXBoundary114231092760192
Content-Type: text/x-vcard; charset="us-ascii";
name=""Oliver Schneider"\##\ showdef = 1.vcf"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline; filename=""Oliver Schneider"\##\ showdef = 1.vcf"



--========GMXBoundary114231092760192--

Jérôme ATHIAS wrote:

>http://www.heise.de/security/artikel/50051
>
>Regards,
>Jérôme ATHIAS
>
>
These are about as much an exploit in my oppinion as emailing users and
telling them to format their hard drive.

--
Colin Alston <karnaugh@karnaugh.za.net>

Quantum Logic Chicken:
The chicken is distributed probabalistically on all sides of the
road until you observe it on the side of your course.

On Monday 16 August 2004 15:58, J=E9r=F4me ATHIAS wrote:
> http://www.heise.de/security/artikel/50051

This basically tells the user to open CMD and then execute the attachment=20
in command line. Now, someone has to be really, really dumb to do that.

The good point here is that people don't know what CMD is and might be=20
reluctant to do something they do not understand. I wouldn't say this is=20
SP2 vulnerability, it might just be that noone tought about such an=20
exploit. However, I think it doesn't have to do with Microsoft, but with=20
less than average IQ of some users. There's no company, not Microsoft, not=
=20
IBM, not Linux nor BSD, that can make a 100% foolproof system.=20

This might be SP2 bug only if the same bug can't be repeated on pre-SP2=20
machine. Didn't test, but I think this is an old trick. Anyone care to=20
test it?
=20
=2D-=20
Radoslav Dejanovi=C4=87
Operacijski sustavi d.o.o.
http://www.opsus.hr

As a work around to the issue - although not to easy to configure for
the home user,

I would think if you have users who are ignorant, gullable, or just
plain stupid - a windows sysadmin might consider a GPO in AD with one or
more of the following policies:

User Configuration --> Administrative Templates --> System --> Prevent
Access to Command Prompt

User Configuration --> Administrative Templates --> System --> Run Only
Allowed Windows Applications

User Configuration --> Administrative Templates --> System --> Don't
Run Specified Windows Applications

Another huge advantage would be the proper implementation of the
following in an AD GPO:

Configure some Software Restriction Policies in User Configuration -->
Windows Settings --> Security Settings --> Software Restrictions

and if possible, couple it with certificates. (although, i'm not too
familiar with this one)

Computer Configuration --> Windows Settings --> Security Settings -->
Local Policies --> Security Options --> System settings: Use
Certificate Rules on Windows Executables for Software Restriction Policies

Given that the scenario behind this presumes that the user downloads an
executable and runs it from the command line one could be just as
vulnerable running Mozilla or any other browser that allows you to
download files. Add a chmod step and other operating systems are just as
"vulnerable."=20

The only remotely interesting point here is that zone information
doesn't follow the files reliably into the file system. Personally I'm
not surprised by this, and it appears that neither is Microsoft. He's
assuming behavior that isn't indicated or documented.

Where do we draw the line on this social engineering stuff? If I send an
e-mail to someone telling them to flush their iPod down the crapper does
that mean the iPod is vulnerable to a toilet attack?

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com=20
-----Original Message-----
From: Oliver Schneider [mailto:Borbarad@gmxpro.net]=20
Sent: Tuesday, August 17, 2004 12:30 PM
To: "J=E9r=F4me" ATHIAS
Cc: bugtraq@securityfocus.com
Subject: Re: First vulnerabilities in the SP2 - XP ?...

Hi,

> http://www.heise.de/security/artikel/50051
I also read this yesterday (the German version) and I think it's not a
vulnerability. It's IMO a misconception in the way how SP2 treats alien
executables. And on the other hand it does not actually lower the value
of
SP2 concerning security - because the rest of SP2 already boosted
security (this time despite compatibility issues - thanks to MS for
finally skipping compatibility in favor of security). But I agree with
the author that MS should fix this anyway!

Can someone please check if ShellExecute()/ShellExecuteEx() behave
different from the CreateProcess-functions *)? Could that be the reason?
Where is the information stored, that a file was downloaded - ADS? -
EAs?
.... some arcane new feature?

Oliver

*) CreateProcess, CreateProcessAsUser, CreateProcessWithLogonW,
CreateProcessWithTokenW

--
---------------------------------------------------
May the source be with you, stranger ...

> From: Radoslav Dejanovi=E6 [mailtoadoslav.dejanovic@opsus.hr]=20
> > On Monday 16 August 2004 15:58, Jrme ATHIAS wrote:
> > http://www.heise.de/security/artikel/50051

> This might be SP2 bug only if the same bug can't be repeated=20
> on pre-SP2 machine. Didn't test, but I think this is an old=20
> trick. Anyone care to test it?

The entire concept of the Zone.Identifier altenate data stream is new to =
XPSP2. Whenever you download any file from the web IE will add an ADS =
called Zone.Identifier which specifies what IE security zone the file =
originated from. Later, when the user tries to execute this file, =
Explorer itself will check for this ADS. If it does not exist Explorer =
will simply execute the file as it has always done, but if it does exist =
and it specifies the Internet zone Explorer will then check for a valid =
digital signature. If such a signature is not found Explorer will prompt =
the user and ask whether to execute this unknown executable from an =
unknown publisher.

Regardless of whether we think this has a high practical impact the =
advisory from J=FCrgen does specify a way to circumvent a desired =
security functionality which has been addded to XPSP2. Circumventing a =
desired security functionality is always interested, especially seeing =
as this is one of many first steps in a move toward digitally signing =
all executables on the Windows platform.



Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
23 Corporate Plaza #280
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Stock symbol: (PIVX.OB)
Phone: +1 (949) 231-8496
PGP: 0x4207AEE9
B5AB D1A4 D4FD 5731 89D6 20CD 5BDB 3D99 4207 AEE9

PivX defines a new genre in Desktop Security: Proactive Threat =
Mitigation.=20
<http://www.pivx.com/qwikfix>

In-Reply-To: <200408180941.16239.radoslav.dejanovic@opsus.hr>


>This basically tells the user to open CMD and then execute the attachment in command line. Now, someone has to be really, really dumb to do that.

People might forget that dragging and dropping to a command prompt actually executes the file.

I have 2 words, Batch files.. I did not get prompted when I double clicked a batch file containing one line "Malicious program.exe"

Sp2 did not also detect that Viri.zip downloaded from the internet and contains an EXE inside it...

I am not trying to create bad press for SP2, I personally think very highly of it...

But I do think people will enter the trap "Wel it's gonna alert me if it's not safe ain't it?" I think that's the biggest issue here

>>People might forget that dragging and dropping to a command prompt
actually executes the file.
>>I have 2 words, Batch files.. I did not get prompted when I double
clicked a batch file containing one line "Malicious program.exe"

Actually, dragging a program icon to a command window doesn't execute
it, it just pastes the full name into the command window. It's not the
same as double-clicking.

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com