• Product Information
• Security Products Overview
• Juniper Networks ISG Series
• IDP Demo
• Product Poster & Z-Card 

Title: Microsoft Windows ntdll.dll Buffer Overflow Vulnerability

Severity: CRITICAL

Description:

The Windows library ntdll.dll includes a function that does not perform sufficient bounds checking. The vulnerability is present in the function "RtlDosPathNameToNtPathName_U" and may be exploited through other programs that use the library if an attack vector permits it. One of these programs is the implementation of WebDAV that ships with IIS. The vector allows for the vulnerability in ntdll.dll to be exploited by a remote attacker.

When a request is made to WebDAV using the methods PROPFIND, LOCK, SEARCH, or GET with the Translate:f header, the request is in turn passed to a function called "GetFileAttributesExW". The "GetFileAttributesExW" makes a call to the vulnerable ntdll.dll function "RtlDosPathNameToNtPathName_U". Proper bounds checking is not performed on the request data, allowing a buffer to be overrun. This could result in the execution of arbitrary code with Local System privileges.

The following library functions also call "RtlDosPathNameToNtPathName_U" and could also be potential attack vectors:

GetShortPathNameW
CopyFileW
MoveFileW
MoveFileExW
ReplaceFileW
CreateMailslotW
GetFileAttributesW
FindFirstFileExW
CreateFileW
GetVolumeInformationW
DeleteFileW
GetDriveTypeW
GetFileAttributesExW
CreateDirectoryW
FindFirstChangeNotificationW
GetBinaryTypeW
CreateNamedPipeW
SetFileAttributesW
MoveFileWithProgressW
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceW
CreateDirectoryExW
DefineDosDeviceW
PrivMoveFileIdentityW
GetCompressedFileSizeW
SetVolumeLabelW
CreateHardLinkW
RemoveDirectoryW

See the link to David Litchfield's paper on this vulnerability in the References section for further details.

**There have been reports that this vulnerability was being actively exploited in the wild for some time before it was discovered and fixed by Microsoft. See the MSNBC link in the References section for more details of systems that were exploited by this vulnerability. It is also important to note that there is a strong possibility that this vulnerability was known to exist for some time prior to March 12th as indicated by the news story.

** Microsoft has revised its advisory to state that this vulnerability affects Windows NT systems. As Windows NT does not support WebDAV, exploits using WebDAV as the attack vector will not be effective against Windows NT systems. Windows XP does not also include WebDAV by default, but other attack vectors may be possible, especially in cases where the attacker has interactive access to the system. WebDAV may be installed by a user on Windows XP with IIS 5.1, so WebDAV may be a possible means of exploitation in these circumstances.

** Reports suggest that numerous hosts have been scanned in an attempt to exploit this vulnerability. Although unconfirmed, this may be the result of a system of automated attacks.

** It has been reported that this vulnerability is also present in the function "RtlGetFullPathName_U". It appears that the main issue is caused by the function "RtlInitUnicodeString" which passes the unicode string to both "RtlDosPathNameToNtPathName_U" and "RtlGetFullPathName_U". These functions both trust the string size that is passed to them by "RtlInitUnicodeString" but cannot handle a string length longer than 16 bits.

** It has been reported that the W32.Welchia.Worm, described in MCID 1811, is actively exploiting this vulnerability.


The patch supplied for Microsoft (Q815021) corrects the issue for both affected functions.

Affected Products:

• Avaya DefinityOne Media Servers
• Avaya IP600 Media Servers
• Avaya S3400 Message Application Server
• Avaya S8100 Media Servers
• Cisco Broadband Troubleshooter
• Cisco Building BroadBand Services Manager Hotspot 1.0.0
• Cisco Building Broadband Service Manager 5.1.0
• Cisco Building Broadband Service Manager 5.2.0
• Cisco Call Manager
• Cisco Call Manager 1.0.0
• Cisco Call Manager 2.0.0
• Cisco Call Manager 3.0.0
• Cisco Call Manager 3.1.0
• Cisco Call Manager 3.1.0 (2)
• Cisco Call Manager 3.1.0 (3a)
• Cisco Call Manager 3.2.0
• Cisco Call Manager 3.3.0
• Cisco Call Manager 3.3.0 (3)
• Cisco CiscoWorks VPN/Security Management Solution
• Cisco Collaboration Server
• Cisco Conference Connection
• Cisco Customer Response Application Server
• Cisco DOCSIS CPE Configurator
• Cisco Dynamic Content Adapter
• Cisco E-Mail Manager
• Cisco Emergency Responder
• Cisco IP Contact Center Enterprise
• Cisco IP Contact Center Express
• Cisco IP Telephony Environment Monitor
• Cisco IP/VC 3540 Application Server
• Cisco IP/VC 3540 Video Rate Matching Module
• Cisco Intelligent Contact Manager
• Cisco Intelligent Contact Manager 5.0.0
• Cisco Internet Service Node
• Cisco Lan Management Solution
• Cisco Media Blender
• Cisco Network Registar
• Cisco Networking Services for Active Directory
• Cisco Personal Assistant
• Cisco QoS Policy Manager
• Cisco Routed Wan Management
• Cisco SN 5420 Storage Router 1.1.0 (2)
• Cisco SN 5420 Storage Router 1.1.0 (3)
• Cisco SN 5420 Storage Router 1.1.0 (4)
• Cisco SN 5420 Storage Router 1.1.0 (5)
• Cisco SN 5420 Storage Router 1.1.0 (7)
• Cisco SN 5420 Storage Router 1.1.3
• Cisco SN 5428 Storage Router SN5428-2-3.3.1-K9
• Cisco SN 5428 Storage Router SN5428-2-3.3.2-K9
• Cisco SN 5428 Storage Router SN5428-2.5.1-K9
• Cisco SN 5428 Storage Router SN5428-3.2.1-K9
• Cisco SN 5428 Storage Router SN5428-3.2.2-K9
• Cisco SN 5428 Storage Router SN5428-3.3.1-K9
• Cisco SN 5428 Storage Router SN5428-3.3.2-K9
• Cisco Secure Access Control Server 3.2.1
• Cisco Secure Policy Manager 3.0.1
• Cisco Secure Scanner
• Cisco Service Management
• Cisco Small Network Management Solution
• Cisco Trailhead
• Cisco Transport Manager
• Cisco Unity Server
• Cisco Unity Server 2.0.0
• Cisco Unity Server 2.1.0
• Cisco Unity Server 2.2.0
• Cisco Unity Server 2.3.0
• Cisco Unity Server 2.4.0
• Cisco Unity Server 2.46.0
• Cisco Unity Server 3.0.0
• Cisco Unity Server 3.1.0
• Cisco Unity Server 3.2.0
• Cisco Unity Server 3.3.0
• Cisco Unity Server 4.0.0
• Cisco User Registration Tool
• Cisco VPN/Security Management Solution
• Cisco VoIP Phone 7902G
• Cisco VoIP Phone 7905G
• Cisco VoIP Phone 7912G
• Cisco Voice Manager
• Cisco Wireless Lan Solution Engine
• Cisco uOne Enterprise Edition
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Advanced Server SP1
• Microsoft Windows 2000 Advanced Server SP2
• Microsoft Windows 2000 Advanced Server SP3
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Datacenter Server SP1
• Microsoft Windows 2000 Datacenter Server SP2
• Microsoft Windows 2000 Datacenter Server SP3
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Professional SP1
• Microsoft Windows 2000 Professional SP2
• Microsoft Windows 2000 Professional SP3
• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Server SP1
• Microsoft Windows 2000 Server SP2
• Microsoft Windows 2000 Server SP3
• Microsoft Windows 2000 Terminal Services
• Microsoft Windows 2000 Terminal Services SP1
• Microsoft Windows 2000 Terminal Services SP2
• Microsoft Windows 2000 Terminal Services SP3
• Microsoft Windows NT Enterprise Server 4.0
• Microsoft Windows NT Enterprise Server 4.0 SP1
• Microsoft Windows NT Enterprise Server 4.0 SP2
• Microsoft Windows NT Enterprise Server 4.0 SP3
• Microsoft Windows NT Enterprise Server 4.0 SP4
• Microsoft Windows NT Enterprise Server 4.0 SP5
• Microsoft Windows NT Enterprise Server 4.0 SP6
• Microsoft Windows NT Enterprise Server 4.0 SP6a
• Microsoft Windows NT Server 4.0
• Microsoft Windows NT Server 4.0 SP1
• Microsoft Windows NT Server 4.0 SP2
• Microsoft Windows NT Server 4.0 SP3
• Microsoft Windows NT Server 4.0 SP4
• Microsoft Windows NT Server 4.0 SP5
• Microsoft Windows NT Server 4.0 SP6
• Microsoft Windows NT Server 4.0 SP6a
• Microsoft Windows NT Terminal Server 4.0
• Microsoft Windows NT Terminal Server 4.0 SP1
• Microsoft Windows NT Terminal Server 4.0 SP2
• Microsoft Windows NT Terminal Server 4.0 SP3
• Microsoft Windows NT Terminal Server 4.0 SP4
• Microsoft Windows NT Terminal Server 4.0 SP5
• Microsoft Windows NT Terminal Server 4.0 SP6
• Microsoft Windows NT Workstation 4.0
• Microsoft Windows NT Workstation 4.0 SP1
• Microsoft Windows NT Workstation 4.0 SP2
• Microsoft Windows NT Workstation 4.0 SP3
• Microsoft Windows NT Workstation 4.0 SP4
• Microsoft Windows NT Workstation 4.0 SP5
• Microsoft Windows NT Workstation 4.0 SP6
• Microsoft Windows NT Workstation 4.0 SP6a
• Microsoft Windows XP 64-bit Edition
• Microsoft Windows XP 64-bit Edition SP1
• Microsoft Windows XP Home
• Microsoft Windows XP Home SP1
• Microsoft Windows XP Professional
• Microsoft Windows XP Professional SP1

References:

• CORE Security: IIS WebDAV exploit
• Cisco: Cisco Security Notice: Nachi Worm Mitigation Recommendations
• M. Burnett <mb@xato.net>: Re: Microsoft Security Advisory MS 03-007
• MSNBC: U.S. military computer attacked
• Microsoft: How to Disable WebDAV for IIS 5.0
• Microsoft: Microsoft Security Bulletin MS03-007

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.