Threat Level: green Handler on Duty: Russ McRee

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Microsoft August 2006 Patches: STATUS

Published: 2006-09-11
Last Updated: 2006-09-11 23:05:04 UTC
by Swa Frantzen (Version: 13)
0 comment(s)
Overview of the known problems and publicly known exploits ofthe August 2006 Microsoft patches.

# Known Problems with this patch
Known Exploits
client rating server rating
MS06-040 Issue with:
  • Huge memory allocations on Windows 2003 server SP1 (32bit & 64bit), XP (64bit) and 32bit application.
  • Microsoft Business Solutions–Navision 3.70 on above platform.
  • Websense Manager when using terminal services
Fix:
  • Hotfix available by calling Microsoft.
More information:
Botnets actively exploiting this in  the WILD

Exploit available in easy to use package



read more...
PATCH NOW
PATCH NOW
MS06-041 No reported problems

Critical Critical
MS06-042 Critical issue:
  • This patch introduces a new arbitrary code execution vulnerability on MSIE 6 SP1.
Fix:
  • Microsoft re-released MS06-042 on Aug 24th 2006.
  • It is unclear if the hotfix that was available earlier fixes this problem as well.

More info:

Issue #1:
  • MSIE 6 SP1 crashes while using multiple application such as Peoplesoft, Siebel, Sage CRM and websites using HTTP 1.1 and compression such as the register.
  • Roll-up patch so it has all older issues as well.
Workaround:
  • Workaround to disable HTTP/1.1
  • Use alternate browser (for problem sites)
Fix:
  • Upgrade to MSIE 6 SP2
  • The re-release of the August 24th is intended to fix this. The fix was supposed to be published by Microsoft on August 22nd, 2006 but was delayed.
More Information:
Issue #2:
  • CA Unicenter Service Desk can cause MSIE to crash, on XP SP2 and Windows 2003 SP1
Workaround:
  • Use the supported Firefox or Mozilla browsers
  • KB923996
Fix:
  • The re-release of MS06-042 is not fixing this problem as far as we know.
More information:

Original MS06-42: fixes a.o. a  FTP vulnerability that;s well-known since 2004

First revision of the MS06-042  patch's buffer overglow has details public.
  • Microsoft released it first on the 22nd
  • actual code fragments were publicly released on the 24th after the patch was updated
PATCH NOW
Important
MS06-043 No reported problems
Important Less urgent
MS06-044 No reported problems
Critical Critical
MS06-045 No confirmed problems
Critical Less urgent
MS06-046 No reported problems
Critical Important
MS06-047 No reported problems Trojan dropper reported in word document by Symantec, Trendmicro(1) and Trendmicro(2).  The dropper loads a backdoor: Trendmicro, Symantec

See also diary.
Critical Less urgent
MS06-048 No reported problems Trojan dropper in Powerpoint Critical Less urgent
MS06-049 Unconfirmed reports about corruption of files on compressed volumes.
[Windows 2000 only patch]

Important
Less urgent
MS06-050 No reported problems
Critical Important
MS06-051 Although unconfirmed by Microsoft so far, there seem to be problems related to Terminal Services and multiple users loading certain DLLs as part of some applications. Details and fixes or workarounds are too sketchy so far.

See also the problem with .ini files and citrix at the citrix support forum.

We're still lookign for a more detailed discription of the problems.

Critical Critical

We will update issues on this page as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
0 comment(s)

Tip of the Day - Like a Kid in a WMIC Candy Store

Published: 2006-08-21
Last Updated: 2006-08-21 23:59:48 UTC
by Ed Skoudis (Version: 1)
0 comment(s)
A long time ago, in a galaxy far, far away (actually, it was about 5 months ago, and I was in the same geographic location), I wrote a diary about WMIC.  For the uninitiated, WMIC is the Windows Management Instrumentation Command-line, an amazing tool for managing Windows boxen at a very fine-grained level.  You can read my previous diary for some ideas I compiled from readers like you on using WMIC to support incident handling.

My previous WMIC article, however, was very focused on attributes of a Windows box… listing them, reading them, and even tweaking a few.  The areas that WMIC can interact with are called aliases, and there are a bunch of them, such as process, os (operating system), nteventlog, startup, etc.  Each of these has its own set of attributes.  To get a list of aliases supported by WMIC, you can do this:

C:\> wmic /?

Then, to get a list of attributes and all of their settings for a given alias, type:

C:\> wmic [alias] list full

But, WMIC is object-oriented, you see, so you've got attributes and methods.  Attributes are cool, letting you get info about your box and tweak it a bit, but methods let you take action on a box, giving you real power.  And, with great power comes great responsibility, as we all know.

To illustrate the difference, consider the sky.  It has attributes (cloud cover, color, etc.).  If Microsoft implemented a WMIC alias for the sky*, you might be able to check your weather by doing something like this:

C:\>  wmic sky list full

Or, even:

C:\> wmic sky where location="NYC" get cloudcover

But, what if you could have methods for the sky?  That would give your real power.  Why, you might be able to do something like this:

C:\> wmic sky call scorch

Now, that would be scary.  Note that you invoke methods using the "call" syntax.

* As far as I know, the sky alias for WMI was originally planned for Windows Vista, but was dropped or majorly tweaked like so many other things.

It occurs to me that, if you were a Jimi Hendrix fan, you could run:

C:\> wmic sky where haze="purple" call kiss

(Sorry, I couldn't resist.)

So, musings about the sky alias aside, let's look at some fun methods we can call for various attributes of Windows.  Keep in mind, that to get a list of methods you can call for any given alias, you could run:

C:\> wmic [alias] call /?

First off, one of the annoying things about "wmic process" is that it doesn't have an attribute for the owner of the process.  But, what the Big Softie left out in attributes, he gave us in methods:

C:\> wmic process where name="cmd.exe" call getowner

Or, even:

C:\> wmic process where name="cmd.exe" call getownersid

Nice!  (Note... Thanks Robert for the pointer about fixing the badly pasted double-double quotes... they are fixed now).

Second, how about this?  Want a built-in command to reboot or shutdown a Windows box (that can even work across the network… see my old article for making this stuff happen remotely)?  Try this (make sure you've saved all work in any running applications first!):

C:\> wmic os where buildnumber="2600" call reboot

Or, replace "reboot" with "shutdown" if that's what you want.  Note that I've found that I have to specify a where clause in the "wmic os" alias whenever I call a method to identify a specific instance, even though there is only one operating system.  Other WMIC aliases don't require the precision of referring to a specific instance, but os does.  Go figure.  Note that on a WinXP box, I refer to the build number, because, for whatever reason, it is easy for me to remember that one.  ;)

Third, let's get into network stuff.  Here's a handy one for getting MAC addresses (and remember, it can be run remotely, too!):

C:\> wmic nic get macaddress

I know, I know… that is attribute oriented.  But I like it… a lot.  You want interface-related methods?  Check these out:

C:\> wmic nicconfig call setdefaultttl 200
C:\> wmic nicconfig call settcpwindowsize 3212

Those change the IP TTL and TCP Window size from default settings to something else, possibly fooling some forms of passive OS fingerprinting.  Be careful with them, though... changing those settings could hose your network performance, make your system ugly, and make your hair fall out.  You have been warned!

Fourth, how about some event log stuff?  To clear the security event log, you could:

C:\> wmic nteventlog where (description like "%secevent%") call cleareventlog

Or, if you just want to get certain kind of events (I'm going to go all attribute on you here again) like those associated with logging onto the box:

C:\> wmic ntevent where (message like "%logon%") list brief

Fifth, here is one that could be useful for handlers:

C:\> wmic netlogin where (name like "%skodo") get numberoflogons

Replace skodo with any other name you are interested in, and it'll show you the cumulative number of times they've logged in to that box historically.  One thing that bothers me here is that WMIC refers to "netlogin" with an "i".  Whenever I write articles and stuff, I always try to use the word "login" when referring to Linux/UNIX and the word "logon" when referring to Windows.  It drives my editors nuts, but it is how these actions are typically referred to in each operating system.  But, here we have a Windows command referring to that action as "login".  Spooky, I tell ya.

-------------

So, enough of my stuff… I'd like to hear from you.  What WMIC methods have you found useful or interesting?  Send them to me, and if they tickle my fancy, I'll summarize them and post them throughout the day.

UPDATE:

ISC reader D. Alan Ridgeway points out that you can use methods associated with "wmic service" to change the service configuration, as in:

C:\> wmic service where (name like "Fax" OR name like "Alerter") CALL ChangeStartMode Disabled

While that is true, I personally prefer the syntax of the sc command.  Still, I could foresee circumstances where the sc command is kaput (and the Services Control Panel is really messed up), so having this option in our WMIC arsenal is helpful.  Thanks, Alan, for the tip!

UPDATE 2:
Fellow Handler Daniel "I beat your CtF game" Wesemann wrote in:

"My favorite:

C:\> wmic /node:box.domain.com qfe where "not description like ''" get description,hotfixid,installedon   [like followed by two single qutes]

to quickly verify if a certain box has a certain patch and when it got applied, rather than to have to tediously log into the patch mgmt system first."

Good stuff, Daniel... thanks...  And your where clause does help to clear out some clutter from the output (although it's rather long to type...)

Another item we got from a mysterious reader desiring some semblance of anonymity involves hunting down apps that shouldn't be used in their enterprise, like file sharing apps.  Writes this mystery person:

"[I really like] the "wmic process" domain, mainly to doublecheck after an IDS alert if a user is
indeed trying to run kazaa or the like before i call him for personal counseling." -- Mysterious Person

ISC reader Matt Wagner has some good ideas, again attribute focused, but useful in spotting discrepancies:

"No methods here, but useful WMIC queries that I have my desktop support folks do to spot any obvious problems when they are working on troubled machines.  They usually run them from a batch file and pipe the output to a text file on the network.  Keep in mind that batch scripts use "%" as escape characters, so you need two of them when doing a "LIKE" condition.

//Spot odd executables
C:\> wmic PROCESS WHERE "NOT ExecutablePath LIKE '%Windows%'" GET ExecutablePath

//Look at services that are set to start automatically
C:\> wmic SERVICE WHERE StartMode="Auto" GET Name, State

//Find user-created shares (usually not hidden)
C:\> wmic SHARE WHERE "NOT Name LIKE '%$'" GET Name, Path

//Find stuff that starts on boot
C:\> wmic STARTUP GET Caption, Command, User

//Identify any local system accounts that are enabled (guest, etc.)
C:\> wmic USERACCOUNT WHERE "Disabled=0 AND LocalAccount=1" GET Name" -- Matt Wagner

Nice stuff, Matt.  I really like the startup alias... it's pro'lly my third favorite (after process and qfe).

FINAL UPDATE:
Well, that's it for me for today.  Thanks for the fun adventures.   I  appreciate all of your helpful comments and insights today.

Get a good rest tonight.  You just might need it.

See you next time!

--Ed Skoudis
Intelguardians
Keywords: ToD
0 comment(s)

Amazon Woes

Published: 2006-08-21
Last Updated: 2006-08-21 20:57:22 UTC
by Ed Skoudis (Version: 1)
0 comment(s)
Just got a message from Eric Haskins pointing out that www.amazon.com is having troubles.  Surfing there indicates:

"We're sorry!

An error occurred when we tried to process your request. Rest assured, we're already working on the problem and expect to resolve it shortly.
If you were trying to make a purchase, please check Your Account to confirm that the order was placed.

We apologize for the inconvenience. "

Looks like my wife's one-click-shopping habit (a.k.a., crack for geeks) will be on hold for a bit.

Interesting, fellow handlers Swa "I'm software, not human" Frantzen mentions that the various country Amazon.com sites are down too, except for Japan.

--Ed Skoudis
Intelguardians

UPDATE:

Now, amazon.com looks OK from a whois lookup at www.internic.net (record points to Network Solutions) and from a Network Solutions whois lookup. 

I just now checked, and they seem to be back up...  so, intermittent problem fixed?  For now...  It's not the end of the world.

--Ed Skoudis
Intelguardians
Keywords:
0 comment(s)

Hack Bill Challenge Winners Announced

Published: 2006-08-21
Last Updated: 2006-08-21 14:16:46 UTC
by Ed Skoudis (Version: 1)
0 comment(s)
A fellow handler, whom I call Ekim Roop, wrote a challenge based on the Tarantino "Kill Bill" movie about a month ago.  Today, he posted the winners of this challenge.

If you are interested in securing sudo, ssh, and pgp/gnupg on Linux, learning a bit more about Bill Stearns' apptrace program, or reading a Kill Bill themed challenge, read the results here.

By the way, I was surprised to see old Ekim write a challenge called "Hack Bill" that did not mention Microsoft at all.  What restraint!
Keywords:
0 comment(s)
Diary Archives