BID:11763

Microsoft Windows WINS Association Context Data Remote Memory Corruption Vulnerability

Info

Microsoft Windows WINS Association Context Data Remote Memory Corruption Vulnerability

Bugtraq ID:	11763
Class:	Boundary Condition Error
CVE:	CVE-2004-1080
Remote:	Yes
Local:	No
Published:	Nov 25 2004 12:00AM
Updated:	Jul 12 2009 08:06AM
Credit:	Discovery is credited to Nicolas Waisman; Kostya Kortchinsky also independently discovered this issue.
Vulnerable:	Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows NT Terminal Server 4.0 SP6a Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Microsoft Small Business Server 2003 Microsoft Small Business Server 2000 0

Not Vulnerable:	Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 SP1 Microsoft Windows 98 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3

Discussion

Microsoft Windows WINS Association Context Data Remote Memory Corruption Vulnerability

It is reported that the WINS replication protocol contains a vulnerability that when exploited will result in memory corruption. The issue exists due to a protocol design flaw that allows a remote user to specify the location of an association context data structure in memory.

Because the attacker may control the location of the data structure, this vulnerability may be exploited to corrupt process memory.

This issue could potentially be exploited remotely by a WINS client to execute arbitrary code with SYSTEM level privileges on a target WINS server. The service may be exposed via TCP/UDP port 42 by default, but the vendor has stated that other attack vectors may exist though none are known at this time.

The WINS service is not installed by default on most Microsoft Windows platforms.

** UPDATE: The WINS service is installed and enabled by default on Microsoft Small Business Server 2000/2003. However, the ports used for the service are reportedly not remotely accessible by default on Small Business Server.

Exploit / POC

Microsoft Windows WINS Association Context Data Remote Memory Corruption Vulnerability

Immunitysec have developed a working commercial exploit for their CANVAS product. This exploit is not otherwise publicly available or known to be circulating in the wild.

CORE have developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Exploit has been released. 101-WINS-v3.cpp is an improved version of 101_WINS.cpp.

/data/vulnerabilities/exploits/wins.c
/data/vulnerabilities/exploits/101_WINS.cpp
/data/vulnerabilities/exploits/101-WINS-v3.cpp

Solution / Fix

Microsoft Windows WINS Association Context Data Remote Memory Corruption Vulnerability

Solution:
Microsoft has released updates to address this vulnerability in supported versions of the Windows operating system.

Microsoft Windows Server 2003 Datacenter Edition