NT Malformed Dialer Entry Vulnerability
BID:554
Info
NT Malformed Dialer Entry Vulnerability
| Bugtraq ID: | 554 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 30 1999 12:00AM |
| Updated: | Jul 30 1999 12:00AM |
| Credit: | Originally discovered by David Litchfield <[email protected]>, and posted to Bugtraq by him on July 29,1999. Microsoft Security Bullettin MS99-026 released July 29, 1999 |
| Vulnerable: |
Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 |
| Not Vulnerable: | |
Exploit / POC
NT Malformed Dialer Entry Vulnerability
quoted from mnemonix's post on Bugtraq:
The following code will create a trojaned dialer.ini file that when read in by dialer will cause it to run a batch file called code.bat - this is hidden from the desktop by calling the equivalent of WinExec("code.bat",0); - and then ExitProcess(0); is called to shutup dialer.exe. Once the dialer.ini has been trojaned the attacker would create a batch file called code.bat and place in there any commands they wished to be run. Needless to say that if a user with admin rights runs dialer any commands placed in this batch file are likely to succeed.
quoted from mnemonix's post on Bugtraq:
The following code will create a trojaned dialer.ini file that when read in by dialer will cause it to run a batch file called code.bat - this is hidden from the desktop by calling the equivalent of WinExec("code.bat",0); - and then ExitProcess(0); is called to shutup dialer.exe. Once the dialer.ini has been trojaned the attacker would create a batch file called code.bat and place in there any commands they wished to be run. Needless to say that if a user with admin rights runs dialer any commands placed in this batch file are likely to succeed.
Solution / Fix
NT Malformed Dialer Entry Vulnerability
Solution:
Microsoft has released a Post-SP5 patch to address this issue. It is available at:
Windows NT Server; Windows NT Server 4.0, Enterprise Edition; and Windows NT Workstation 4.0:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/Dialer-fix
Windows NT Server 4.0, Terminal Server Edition:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40tse/hotfixes-postSP4/Dialer-fix
Solution:
Microsoft has released a Post-SP5 patch to address this issue. It is available at:
Windows NT Server; Windows NT Server 4.0, Enterprise Edition; and Windows NT Workstation 4.0:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/Dialer-fix
Windows NT Server 4.0, Terminal Server Edition:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40tse/hotfixes-postSP4/Dialer-fix