NT IIS MDAC RDS Vulnerability

Bugtraq ID:	529
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 19 1999 12:00AM
Updated:	Jul 19 1999 12:00AM
Credit:	Microsoft Security Bulletin MS98-004 released July 14, 1998, rereleased as MS99-025 on July 19, 1999. Additional information posted to NTBugtraq on July 19, 1999 by Greg Gonzalez <[email protected]>. Additional information and exploit posted to Bugtraq on
Vulnerable:	Microsoft Site Server Commerce Edition 3.0 i386 + Hancom Hancom Office 2007 0 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 + Microsoft Commercial Internet System 2.0 + Microsoft Site Server Commerce Edition 3.0 alpha - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 Microsoft Index Server 2.0 + Microsoft IIS 4.0 + Microsoft IIS 4.0 Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft IIS 3.0 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Data Access Components (MDAC) 2.1 UPGRADE Microsoft Data Access Components (MDAC) 2.1 CLEAN Microsoft Data Access Components (MDAC) 2.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Data Access Components (MDAC) 1.5 + Microsoft Windows NT 4.0 + Microsoft Windows NT 4.0 + Microsoft Windows NT 4.0
Not Vulnerable:

NT IIS MDAC RDS Vulnerability

MDAC (Microsoft Data Access Components) is a package used to integrate web and database services. It includes a component named RDS (Remote Data Services). RDS allows remote access via the internet to database objects through IIS. Both are included in a default installation of the Windows NT 4.0 Option Pack, but can be excluded via a custom installation.

RDS includes a component called the DataFactory object, which has a vulnerability that could allow any web user to:
--Obtain unauthorized access to unpublished files on the IIS server
--Use MDAC to tunnel ODBC requests through to a remote internal or external location, thereby obtaining access to non-public servers or effectively masking the source of an attack on another network.

The main risk in this vulnerability is the following:
--If the Microsoft JET OLE DB Provider or Microsoft DataShape Provider are installed, a user could use the shell() VBA command on the server with System privileges. (See the Microsoft JET Database Engine VBA Vulnerability for more information). These two vulnerabilities combined can allow an attacker on the Internet to run arbitrary commands with System level privileges on the target host.

NT IIS MDAC RDS Vulnerability

msadc.pl exploit written and posted to bugtraq by Rain Forest Puppy.
RDSExploit.zip exploit written and emailed to SecurityFocus by Wanderley J. Abreu Jr

--msadc.pl explanation: (RDSExploit explanation is after this)
msadc.pl looks for a common file to exploit, namely btcustmr.mdb .
msadc.pl instructions:
run perl -x msadc.pl
Command line switches (copied from rfp's post):

-h <ip or domain> this is the host to scan. You MUST either
use either -h or -R.

-d <value 0-?> this is the delay between connections.
Value is in number of seconds. I added
this because hammering the RDS components
caused the server to occasionally stop
responding :) Defaults to 1. Use -d 0
to disable.

-V Use VbBusObj instead of DataFactory to
run the queries. NOTE: please read the -N
information below as to suggestions for
checking if VbBusObj exists. VbBusObj
does not give good error reporting;
therefore it is quite possible to have
false positives (and false negatives).
Consider VbBusObj support 3 stages before
beta. Don't say I didn't warn you.

-v verbose. This will print the ODBC error
information. Really only for
troubleshooting purposes.

-e external dictionary file to use on step
5--the 'DSN dictionary guess' stage. The
file should just be plaintext, one DSN
name per line file with all the DSN names
you want to try. Quite honestly a normal
dictionary file won't do you much good.
You can probably do pretty damn well with
a few dozen or two good ones, like 'www',
'data', 'database', 'sql', etc.

-R resume. You can still specify -v or -d
with -R. This will cause the script to
read in rds.save and execute the command
on the last valid connection.

-N Use VbBusObj to try to get the machine's
NetBIOS name. It may return no name
if the VbBusObj is unavailable. I suggest
you use -N to see if VbBusObj exists (a
NetBIOS name will be returned if so)
before you use -V.

-X perform an Index Server table dump instead.
None of the other switches really apply
here, other than -v (although -d still
works, there's no need to slow down one
query). This dumps the root paths from
Index Server, which can be rather lengthy.
I suggest you pipe the output into a file.
Also, if there is a lot of return
information, this command may take a while
to complete. Be patient. And I don't
suggest you use this command more than
once a minute...it caused my P200 w/
128 RAM to stop answering requests, and
in general borked inetinfo.exe. If you do
decide to CONTROL-C during the middle of the
data download the script will save all
received data into a file called 'raw.out',
so you don't loose everything you've
already received. NOTE: this is the raw
data, which is in Unicode.

rfp submitted a version 2 of this exploit on October 10, 1999. New features include:

- UNC support. This has only been tested with Windows 95 shares...NT may
cause authentication wackiness. Use -u \\server\share\file.mdb.
Also, on unix boxen, don't forget you have to escape the '\', so
would look like \\\\server\\share\\file.mdb. Also have not tested
with Samba. Let me know if you have good/bad results.

- Win 95 support. Use -w to use command /c instead of cmd /c.

- Slimmed down the query process. Before it would query to determine if
it was using Access driver, then create a table called 'AZZ', and
then try to use this 'AZZ' table for the exploit. This left
obvious leftovers (tables named 'AZZ') on the server. Now it just
queries MSysModules firsthand, which cuts down the steps and stops
leaving evidence. However, this may not always work. Use the -c
switch for backwards compatibility (3 step process). I would run
normal, and if nothing works, try it again with the -c switch.

- Only run a certain step. Use the -s switch to specify which step to
run. For those of you itching to try the new UNC support, you
can run it immediately (normally it's step 5), by running:

./msadc.pl -h <host> -u <unc path> -s 5



NOTE ON SUCCESS: The script reports 'Success!' when it has issued a valid
SQL statement. 'Success!' does *NOT* mean that your command worked. If
they have MDAC 2.1+ shell commands are worthless, so the script will
report 'Success!' (it went through) but your command didn't run (MDAC 2.1
didn't interpret it). There's no return indication to know whether your
command worked or not. As with the ODBC commands, you're flying blind.

--RDSExploit information:
RDS EXPLOITER For Win98/NT
 
 
How it Works:
 
        The Intent of RDS Exploit is Deliver Shell comands into the machine or Retrive some DATA from a ODBC valid conection.
      
1. Seting ODBC Conection:
First of all you will need to know some valid DSN, the UID (User ID) and Password.  Put the information about the conection into "Connection Properties":
Data Source: The DSN Conection Name (it MUST be a registered DSN)
User ID: Login (it can be null sometimes)
Password: Password (it can be null sometimes)  
Mode: The way you want to open the Table (Read Only or Read and Write)
 
You must follow the order above and don't forget the ; to separate the options
 It can be for instance a line like this:
"Data Source=AdvWorks;User ID=;Password=;Mode=Read|Write;"
  
2. SQL Comands:
Put into the "SQL Parameters" box the command line you want to deliver for example:
"SELECT * FROM Products"

3. Host:
 You MUST Enter the host like this http://server  DON'T FORGET HTTP:// or it'll not work.
 
After all done, just click in the button "Retrieve Data" and see what happens =)
 

• /data/vulnerabilities/exploits/msadc.pl
• /data/vulnerabilities/exploits/RDSExploit.zip

NT IIS MDAC RDS Vulnerability

Solution:
If you have MDAC 1.5 or 2.x installed on the IIS server and DO NOT need MDAC functionality, perform the following:
--Delete the /msadc virtual directory in IIS, or
--Remove the following registry keys and all of their subkeys on the IIS server:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.DataFactory
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDataFactory
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.VbBusObjCls

If you need MDAC capabilties, you should:
--Install the latest version of MDAC 2.1.2.4202.3 (GA) (also known as MDAC 2.1 SP2) from:
http://www.microsoft.com/data/download.htm
--Disable Anonymous Access to the /msdac virtual directory
--Create a Custom Handler to filter incoming requests. More information on this is available at:
http://www.microsoft.com/Data/ado/rds/custhand.htm
these changes have been placed in a registry file:
http://www.microsoft.com/security/bulletins/handsafe.exe
this file implements the following Registry keys:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataFactory]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataFactory\HandlerInfo
"handlerRequired"=dword:00000001
"DefaultHandler"="MSDFMAP.Handler"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataFactory\HandlerInfo\safeHandlerList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataFactory\HandlerInfo\safeHandlerList\MSDFMAP.Handler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataFactory\HandlerInfo\safeHandlerList\MSDFMAP_VB.Handler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataFactory\HandlerInfo\safeHandlerList\MSDFMAP_VC.Handler

--Remove all sample pages.

NT IIS MDAC RDS Vulnerability

References:

• Microsoft JET Database Engine VBA Vulnerability (SecurityFocus)
  
• Microsoft Security Bulletin: (MS99-025): Frequently Asked Questions (Microsoft)
  
• Q184375 - Security Implications of RDS 1.5, IIS 3.0 or 4.0, and ODBC (Microsoft)