G-06A: Win95 Vulnerabilities

PROBLEM:        1. A weak encryption algorithm allows the password
                   cache to be decrypted and read.
                2. A problem in the file sharing/remote administration
                   facility gives administrative access on a Win 95
                   machine to unauthorized users.
PLATFORM:       Windows 95
DAMAGE:         1. Anyone who can obtain a copy of the Windows 95
                   password cache could obtain usernames and passwords
                   for all of a user's password protected services,
                   including passwords for logins to remote systems and
                   file servers.
                2. Network users may obtain read only access to a machine.
SOLUTION:       Apply replacement modules from Microsoft.

VULNERABILITY   1. The password cache vulnerability allows an
ASSESSMENT:        intruder who can obtain a copy of the password
                   cache file to gain access to any remote 
                   systems and servers that the user had access to. 
                2. The file and printer sharing vulnerability only affects
                   those systems where file sharing and remote
                   administration are enabled and the administrator has
                   logged in and logged off. Rebooting the machine sets
                   the access back to normal.

1. PASSWORD CACHE VULNERABILITY

PROBLEM

Note that to exploit this vulnerability, an intruder must be able to obtain a copy of the password cache file. To obtain a copy, he must have physical access to the machine, or the file must be in a shared directory that the intruder can read.

SOLUTION

Description:
http://www.microsoft.com/windows/software/mspwlupd.htm
Update:
http://www.microsoft.com/windows/download/mspwlupd.exe

Copy the MSPWLUPD.EXE file to a directory on a Windows 95 machine and run it. The update program automatically updates your password file to the new format and installs MSPWL32.DLL and NET.EXE. If you have turned off password caching using the Policy Editor, the updater program gives you the option to turn it back on. The operation of NET.EXE is also changed by this update. NET.EXE, which is usually used from the command line, will no longer use the password cache. Users will be prompted for passwords whenever they use NET.EXE.

In addition to patching the files, you should insure that strong passwords are used to secure the cache file. A password policy can be enforced by using the policy editor to set the minimum password length and force the password to be alphanumeric. The policy editor is available on the Windows 95 CD-ROM (not on the floppy disk version) in \admin\apptools\poledit. It is also available at the Microsoft WWW site in:

http://www.microsoft.com/windows/software/admintools.htm

Instructions for installing the policy editor come with the tool.

Another useful tool is the Password Cache Editor. This editor lets you edit a password cache file and remove any passwords that do not need to be stored in it. The password editor is available in the "Microsoft Windows 95 Resource Kit" or at the same location as the policy editor at the Microsoft WWW site.

2. FILE SHARING/REMOTE ADMINISTRATION VULNERABILITY

PROBLEM

First, for the network client driver "File and Printer Sharing for NetWare Networks" an intruder can obtain read access to the files on a user's machine. To be at risk, a system:

1. Must be configured to share files and printers with other users on the network using the "File and Printer Sharing for NetWare Networks" client.

2. Must have remote administration enabled or have installed Microsoft Remote Registry Services.

3. The administrator must have logged on and logged off of the machine.

Second, for the network client driver "File and Printer Sharing for Microsoft Networks" a problem exists with the Samba network client running on a UNIX system, that may allow file access by intruders on the local network or on the Internet. To be at risk, a system:

1. Must be configured to share files and printers with other users on the network using the "File and Printer Sharing for Microsoft Networks" client.

2. Must share a LAN, Internet, or Dial-Up connection with a UNIX-based computer running Samba's SMBCLIENT software.

3. Must not have peer services disabled using System Policies.

SOLUTION

File and Printer Sharing for NetWare Networks

File and Printer Sharing for Microsoft Networks

Descriptions:
http://www.microsoft.com/windows/software/w95fpup.htm

File and Printer Sharing for NetWare Networks driver:
http://www.microsoft.com/windows/download/nwsrvupd.exe

File and Printer Sharing for Microsoft Networks driver: http://www.microsoft.com/windows/download/vservupd.exe

Both drivers are also available from The Microsoft Network online service, and have been made available to other online services including CompuServe, America Online, and Prodigy. The updated drivers will also be mailed to any user free of charge if they call Microsoft's FastTips line, 800/936-4200.

To install the new drivers, insert the driver installer files in a directory on the Windows 95 machine and run them. The new drivers are automatically installed in your Windows 95 system.

    Voice:          +1 866-941-2472 (7 x 24)
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov/