NULL sessions vulnerabilities using alternate named pipes
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NULL sessions vulnerabilities using alternate named pipes
Hervé Schauer Consultants Security Advisory
http://www.hsc.fr/
- -[ Summary ]-
Advisory: NULL sessions vulnerabilities using alternate named pipes
CVE identifier: CAN-2005-2150
Release date: 2005/07/07
Affected systems: Windows NT 4.0, Windows 2000
Vendor status: Windows 2000 fixes available in URP1 for Windows 2000 SP4
Author: Jean-Baptiste Marchand <Jean-Baptiste.Marchand@xxxxxx>
References: http://www.hsc.fr/ressources/presentations/null_sessions/
- -[ Affected systems ]-
- Windows NT 4.0
- Windows 2000 (prior to URP1 for Windows 2000 SP4)
Windows XP and Windows Server 2003 are not directly affected by the
vulnerabilities described in this document.
Still, the alternate named pipes technique also applies to Windows XP and
Windows Server 2003, including Windows XP SP2 and Windows Server 2003 SP1.
- -[ History ]-
2004/01/23: vulnerability reported to vendor
2004/02/12: vendor announces its intention to release fixes as part of the next
Windows 2000 Service Pack
2004/09/09: a related vulnerability affecting Windows XP SP2 is published
2005/02/08: release of MS05-007, fixing a specific instance of a similar
vulnerability in Windows XP and Windows XP SP2
2005/02/28: private versions of Windows 2000 fixes available for test
2005/03/30: confirmation that tested fixes correct the vulnerability
2005/06/28: release of URP1 for Windows 2000 SP4, which includes fixes for
Windows 2000
- -[ Overview ]-
By taking advantage of hardcoded named pipes allowed for NULL sessions and using
the property of MSRPC that, by default, all available RPC interfaces in a
process can be reached using any opened endpoint, it is possible to:
- anonymously enumerate Windows services of a remote Windows NT 4.0 or Windows
2000 system (svcctl vulnerability)
- anonymously read the Application and System eventlogs of a remote Windows NT
4.0 or Windows 2000 system (eventlog vulnerability)
- -[ svcctl vulnerability details ]-
The svcctl MSRPC interface is used to communicate with the Windows SCM (Service
Control Manager):
http://www.hsc.fr/ressources/articles/win_net_srv/ch04s07s09.html
The svcctl vulnerability allows an anonymous user to connect to the SCM (Service
Control Manager). It is then possible to enumerate installed or running
services:
http://www.hsc.fr/ressources/presentations/null_sessions/img16.html
Depending on the security descriptor protecting each service (stored in binary
under the Security registry subkey of each service's subkey), it might be
possible to anonymously start or even stop a Windows service.
Because in Windows NT 4.0 and Windows 2000, the EVERYONE group contains the
ANONYMOUS LOGON SID, a service with a weak DACL allowing members of the EVERYONE
group to start (or stop) the service can be remotely started or stopped
anonymously.
For more information about services permissions, see
http://cert.uni-stuttgart.de/archive/bugtraq/2004/10/msg00159.html
- -[ eventlog vulnerability details ]-
The eventlog MSRPC interface is used to communicate with the Windows eventlog
service:
http://www.hsc.fr/ressources/articles/win_net_srv/ch04s07s06.html
The eventlog vulnerability can be used to anonymously read either the
Application or System eventlog of a remote Windows NT 4.0 or Windows 2000
system.
It is not possible to read the Security eventlog because a specific Windows
privilege must be held by the caller process (SeSecurityPrivilege).
- -[ Workaround ]-
Both vulnerabilities are fixed in the URP1 for Windows 2000 SP4 recently
released by the vendor:
http://support.microsoft.com/kb/900345/
The svcctl vulnerability was fixed by modifying the SCM DACL (enforced when the
OpenSCManager{A,W} operation is used), denying access for the ANONYMOUS LOGON
SID.
The eventlog vulnerability was fixed by using a RPC callback function for the
eventlog interface, to reject unauthenticated binds.
It is also possible to protect against the eventlog vulnerability by adding and
setting to 1 the RestrictGuestAccess registry value, under the following two
registry keys:
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\System\
In Windows 2000, the RestrictGuestAccess value can be set using the following
security options:
- Restrict guest access to application log
- Restrict guest access to system log
These settings are mentionned in the following article:
http://support.microsoft.com/kb/842209
It is recommended to set these registry values on Windows NT 4.0 systems, where
no other workaround is available.
- -[ Vulnerability assessment ]-
Plugins for the Nessus vulnerability scanner are available to discover
vulnerable hosts:
svcctl vulnerability:
http://www.nessus.org/plugins/index.php?view=single&id=18585
eventlog vulnerability:
http://www.nessus.org/plugins/index.php?view=single&id=18602
- -[ References ]-
For more information, see the following documents:
- MSRPC null sessions: exploitation and protection
http://www.hsc.fr/ressources/presentations/null_sessions/
- Windows network services internals
http://www.hsc.fr/ressources/articles/win_net_srv/
- -[ Credits ]-
These vulnerabilities were discovered by Jean-Baptiste Marchand, with the help
of Hervé Schauer Consultants team.
- -[ Copyright ]-
The contents of this advisory are copyright (c) 2005 Hervé Schauer Consultants
and may be distributed freely provided that no fee is charged for this
distribution and proper credit is given.
- -[ PGP key ]-
http://www.hsc.fr/~marchand/marchand.asc
pub 1024D/456EBCD4 2003-02-25
Key fingerprint = F360 8D66 5AD1 AD17 1941 D14F D0F0 EA74 456E BCD4
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
iD8DBQFCzOpm0PDqdEVuvNQRAgJPAJ0aK/uD9n/2U8qO8od+sgHmIbuVpgCg1Xgq
rztKIps8npljcawk6PgJzNs=
=97XV
-----END PGP SIGNATURE-----