Microsoft JET Database Engine VBA Vulnerability

Bugtraq ID:	286
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	May 25 1999 12:00AM
Updated:	May 25 1999 12:00AM
Credit:	This vulnerability was published in the BUGTRAQ mailing list by Matthew Astley and Rain Forest Puppy <[email protected]>. Exploit posted to Bugtraq by Wanderley J. Abreu Junior <[email protected]>.
Vulnerable:	Microsoft JET 3.51 + Microsoft Excel 95 + Microsoft Excel 95 + Microsoft Excel 97 + Microsoft Excel 97 Microsoft JET 3.5 + Microsoft Access 95 + Microsoft Access 95 + Microsoft Access 97 + Microsoft Access 97 Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:	Microsoft JET 4.0 SP1 Microsoft JET 4.0 + Microsoft Access 2000 + Microsoft Access 2000

Microsoft JET Database Engine VBA Vulnerability

Microsoft's JET database engine feature allows the embedding of Visual Basic for Application in SQL string expressions and the lack of metacharacter filtering by many web applications may allow remote users to execute commands on the system.

Microsoft's JET database engine (the core of Microsoft Access) allows the embedding of Visual Basic for Application expressions in SQL strings. VBA expressions withing two "|" characters within an SQL string will be executed and its result substituted in the string. The VBA code is evaluated in an expression context. That means you cannot make use of statements.

The Microsoft JET database engine can be used via the ODBC API. It is commonly used as a backend for web enabled applications. The fact that it uses the "|" character to execute VBA code within SQL statements in JET is a largely unknown feature, meaning that few applications escape user input for this metacharacter. Therefore any script or application that uses Microsoft's JET ODBC DSN could potentially be exploited.

Microsoft's IIS in particular executes ODBC commands in the context of the System account. This may allow remote attackers to input VBA code in web enabled applications that will be executed by IIS as the System user.

The most dangerous VBA command available to an attacker is shell(), which enables it to run any command in the system.

Microsoft's IIS 4.0 ships with a number of sample scripts that are vulnerable if used with the JET ODBC driver (e.g. details.idc). It also ships with MSADC which allows remote uses to execute SQL queries on a DNS via HTTP.

Tests seem to indicate JET 4.0 is not vulnerable to this issue.

Microsoft JET Database Engine VBA Vulnerability

This exploit uses an ASP sample page (catalog_type.asp). It lets you execute shell comands like the other scripts. It is an Active Server Page so it runs the query as a local user and doesn't need any type of Remote Data Service to access the DSN. It just requires the default DSN (advworks) set.

http: //server/AdvWorks/equipment/catalog_type.asp?ProductType=|shell("cmd+/c+dir+c:\")|

Scrippie <[email protected]> has released the following exploit:

• /data/vulnerabilities/exploits/dsnhack.pl

Microsoft JET Database Engine VBA Vulnerability

Solution:
Disable the JET ODBC drivers or upgrade to JET 4.0 or later. Please note that JET 4.0 may not be fully compatible with earlier versions and some applications may fail. JET 4.0 is part of Microsoft's Data Access (MDAC) 2.1.

Microsoft JET Database Engine VBA Vulnerability

References: