NT DCOM Server Vulnerability

Bugtraq ID:	624
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 08 1999 12:00AM
Updated:	Sep 08 1999 12:00AM
Credit:	Posted to Bugtraq on September 8, 1999 by Mnemonix <[email protected]>
Vulnerable:	Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0
Not Vulnerable:

NT DCOM Server Vulnerability

It is possible for a local user to modify how DCOM servers are run, thereby escalating his/her privilege level. The Interactive User has write permissions to the DCOM registry entries. By editing the registry keys associated with DCOM server applications, they can change which services are started to handle specific events. They can then overwrite the services EXE file, trigger the event, and have their code run as SYSTEM.

NT DCOM Server Vulnerability


This exploit will cause the System Event Notification service or SENS service to start when a VBScript calls for the creation of a new Wordpad Document. The SENS service is installed during an installation of IE5, but is not started. The default permissions allow Everybody write access to the EXE.
Edit the
HKCR\AppID\{73FDDC80-AEA9-101A-98A7-00AA00374959}
registry key and add a new value, "LocalService", with data SENS

Create an HTML document, with the following VBScript in it:
<SCRIPT LANGUAGE="VBScript"> CreateObject("Wordpad.Document.1") </SCRIPT>

Open the html document in a browser. The browser will request that the COM Service Control Manager (RPCSS.EXE) start the service associated with Wordpad.

NT DCOM Server Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

NT DCOM Server Vulnerability

References: