===================================================================== CERT-Renater Note d'Information No. 2006/VULN415 _____________________________________________________________________ DATE : 28/07/2006 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running ISS Products. ====================================================================== Internet Security Systems Security Alert July 26, 2005 Protocol Parsing Bug in SMB Mailslot Parsing in ISS Products Version: 1.0 CVSS Score: Access Vector: Remote Access Complexity: High Authentication: Not Required Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete Impact Bias: Availability Base Score: 2 Exploitability: Proof of concept Remediation Level: Official Fix Report Confidence: Confirmed Temporal: 1.6 Synopsis: A protocol parsing bug was discovered within ISS July 2006 XPU SMB_MailSlot_Heap_Overflow decode. This decode is designed to provide protection for the Microsoft SMB/TCP Mailslot vulnerability (MS06-035), but can be adversely affected by certain types of legitimate SMB Mailslot network traffic. In the worst case scenario, some host-based protection products will suffer from a denial of service. Affected Versions: See knowledgebase article: https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=3630 Impact: The protocol parsing bug is caused by incorrect parsing of SMB/TCP Mailslot information. The flaw may be triggered by certain types of legitimate SMB Mailslot traffic. ISS X-Force has confirmed that exploitation of this issue, which results in remote access, is NOT possible; however, it can cause a denial of service. In the worst case scenario, host-based products will loose network connectivity requiring a host restart. Description: ISS July XPUs provided virtual patch protection for Microsofts MS06-035 vulnerability. However, a bug in the logic for the virtual patch decode, SMB_MailSlot_Heap_Overflow, may be triggered when encountering certain types of legitimate SMB Mailslot traffic, which would result in the protocol analysis module (PAM) engine not responding to subsequent network traffic. This denial of service is managed differently by each ISS product that utilizes PAM. It is important to note that PAM will successfully protect against possible exploit attempts of the SMB Mailslot vulnerability (MS06-035). The default affect of the protocol parsing bug in the ISS protection products is dependant upon the protection platform. An ISS knowledgebase has been produced, which details how each protection product handles the bug, can be found at: https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=3630 Mitigating Factors: * Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed. In particular blocking TCP port 445 at the firewall will help protect systems that are behind that firewall from attempts to exploit this vulnerability. * Microsoft Windows XP Service Pack 2 and Microsoft Windows Server 2003 Service Pack 1 do not have services listening on Mailslots in default configurations. Recommendations: ISS X-Force recommends that customers immediately update to the newest XPU provided by ISS. These XPUs contains a fix for this vulnerability. ISS has already made the following updates available to remedy this vulnerability: RealSecure Network 7.0, XPU 24.40 Proventia A Series, XPU 24.40 Proventia G Series, XPU 24.40/1.79 Proventia M Series, XPU 1.79 RealSecure Server Sensor 7.0, XPU 24.40 Proventia Server 1.0.914.1880 RealSecure Desktop 7.0 epk Proventia Desktop 8.0.812.1790/8.0.675.1790 BlackICE PC Protection 3.6 cpk BlackICE Server Protection 3.6 cpk Updates are available from the ISS Download Center: http://www.iss.net/download/ As a temporary workaround while the updates are being applied and as a general security best-practice, it is recommended that SMB traffic be blocked at network perimeters. Additional Information: http://www.nsfocus.com Credit: ISS X-Force would like to thank the NSFOCUS Security Team for notifying ISS of the issue. ______ About Internet Security Systems, Inc. Internet Security Systems, Inc. (ISS) is the trusted security advisor to thousands of the world's leading businesses and governments, providing preemptive protection for networks, desktops and servers. An established leader in security since 1994, ISS' integrated security platform automatically protects against both known and unknown threats, keeping networks up and running and shielding customers from online attacks before they impact business assets. ISS products and services are based on the proactive security intelligence of its X-Force research and development team - the unequivocal world authority in vulnerability and threat research. ISS' product line is also complemented by comprehensive Managed Security Services. For more information, visit the Internet Security Systems Web site at www.iss.net or call 800-776-2362. Copyright (c) 2006 Internet Security Systems, Inc. All rights reserved worldwide. This document is not to be edited or altered in any way without the express written consent of Internet Security Systems, Inc. If you wish to reprint the whole or any part of this document, please email xforce@iss.net for permission. You may provide links to this document from your web site, and you may make copies of this document in accordance with the fair use doctrine of the U.S. copyright laws. Disclaimer: The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. X-Force PGP Key available on MIT's PGP key server and PGP.com's key server, as well as at http://www.iss.net/security_center/sensitive.php Please send suggestions, updates, and comments to: X-Force xforce@iss.net of Internet Security Systems, Inc. Revisions: Version 1.0 July 25, 2006 - Initial alert release ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================