M-107: Microsoft Unchecked Buffer in Content Management Server

[***** Start Microsoft Security Bulletin MS02-041 *****]

Microsoft Security Bulletin MS02-041    

Unchecked Buffer in Content Management Server Could Enable Server Compromise (Q326075)
Originally posted: August 7, 2002

Summary

Who should read this bulletin: System administrators using Microsoft® Content 
Management Server 2001. 

Impact of vulnerability: Three vulnerabilities, the most serious of which could enable 
an attacker to gain full control over the server 

Maximum Severity Rating: Critical 

Recommendation: System administrators should apply the patch immediately. 

Affected Software: 

    Microsoft Content Management Server 2001 

Technical details

Technical description: 

Microsoft Content Management Server (MCMS) 2001 is a .Net Enterprise Server product 
that simplifies developing and managing e-business web sites. Microsoft has learned of 
three security vulnerabilities affecting it: 

A buffer overrun in a low-level function that performs user authentication. At least 
one web page included with MCMS 2001 passes inputs directly to the function, thereby 
potentially providing a way for an attacker to overrun the buffer. The result of 
exploiting the vulnerability would be to either cause MCMS to fail, or run code in the 
context of the MCMS service (which runs as Local System). 

A vulnerability resulting from the confluence of two flaws affecting a function that 
allows files to be uploaded to the server. The first flaw lies in how the function 
authenticates requests, and would allow any user to submit an upload request. The 
second results because it is possible to override the upload location; where the 
function should upload files to a folder that only privileged users can access, it can 
be overridden to upload it to a temporary folder that does allow unprivileged users to 
call it. By exploiting the two flaws in tandem, an attacker could upload an .ASP or 
other file to the server, in a location from which it could be executed. 

A SQL injection vulnerability affecting a function that services requests for image 
files and other resources. Exploiting the vulnerability could enable an attacker to 
run SQL commands on the server, which would not only allow data in the MCMS database 
to be added, changed or deleted, but also would enable the attacker to run operating 
system commands on the server. 

Mitigating factors: 

Buffer Overrun in MCMS Authentication Operation: 

The scope of the vulnerability could be significantly reduced if the URLScan tool were 
deployed on the server. It is likely that in this case, the vulnerability could only 
be used for denial of service attacks. 

Program Execution via MCMS Authoring Function: 

Exploiting the vulnerability would not grant the attacker administrative privileges on 
the server. Instead, the attacker's code would execute in the security context of the 
Web Application Manager (the IWAM_computername account), which has similar privileges 
to those of an interactively logged-on user. 

SQL Injection via MCMS Resource Request: 

Exploiting the vulnerability would not grant the attacker administrative privileges on 
the server. Instead, any operating system commands would be levied in the security 
context of the SQL Server™ 2000 service, which by default has only Domain User 
privileges. 

Severity Rating: 

Buffer Overrun in MCMS Authentication Operation:  
  Internet Servers  - Critical 
  Intranet Servers  - Critical
  Client Systems    - None

Program Execution via MCMS Authoring Function:  
  Internet Servers  - Moderate 
  Intranet Servers  - Moderate
  Client Systems    - None

SQL Injection via MCMS Resource Request:
  Internet Servers  - Moderate 
  Intranet Servers  - Moderate
  Client Systems    - None

The above assessment is based on the types of systems affected by the vulnerability, 
their typical deployment patterns, and the effect that exploiting the vulnerability 
would have on them. 

Vulnerability identifiers: 

Buffer Overrun in MCMS Authentication Operation: 
CVE-CAN-2002-0700 
Program Execution via MCMS Authoring Function: 
CVE-CAN-2002-0718 
SQL Injection via MCMS Resource Request: 
CVE-CAN-2002-0719 

Tested Versions:
Microsoft tested Microsoft Content Management Server 2001 to assess whether it is 
affected by these vulnerabilities. Previous versions are no longer supported, and may 
or may not be affected by these vulnerabilities.

Patch availability

Download locations for this patch 

Microsoft Content Management Server 2001:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=41266


Additional information about this patch

Installation platforms: 
This patch can be installed on systems running Microsoft Content Management Server 
2001 Service Pack 1 

Inclusion in future service packs:
The fix for this issue will be included in Microsoft Content Management Server 2001 
Service Pack 2. 

Reboot needed: No 

Patch can be uninstalled: Yes 

Superseded patches: None. 

Verifying patch installation: 

To verify that the patch has been installed on the machine, confirm that the following 
registry key has been created on the machine: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\MCMS 2001\Q326075 

Caveats:
None 

Localization:
Microsoft Content Management Server 2001 is English only, so localized patches are not 
required. 

Obtaining other security patches: 
Patches for other security issues are available from the following locations: 

Security patches are available from the Microsoft Download Center, and can be most 
easily found by doing a keyword search for "security_patch". 
Patches for consumer platforms are available from the WindowsUpdate web site

Other information: 

Acknowledgments
Microsoft thanks Joao Gouveia for reporting this issue to us and working with us to 
protect customers. 

Support: 

Microsoft Knowledge Base article Q326075 discusses this issue and will be available 
approximately 24 hours after the release of this bulletin. Knowledge Base articles can 
be found on the Microsoft Online Support web site. 

Technical support is available from Microsoft Product Support Services. There is no 
charge for support calls associated with security patches. 

Security Resources: The Microsoft TechNet Security Web Site provides additional 
information about security in Microsoft products. 

Disclaimer: 
The information provided in the Microsoft Knowledge Base is provided "as is" without 
warranty of any kind. Microsoft disclaims all warranties, either express or implied, 
including the warranties of merchantability and fitness for a particular purpose. In 
no event shall Microsoft Corporation or its suppliers be liable for any damages 
whatsoever including direct, indirect, incidental, consequential, loss of business 
profits or special damages, even if Microsoft Corporation or its suppliers have been 
advised of the possibility of such damages. Some states do not allow the exclusion or 
limitation of liability for consequential or incidental damages so the foregoing 
limitation may not apply. 

Revisions: 

V1.0 (August 7, 2002): Bulletin Created. 

[***** End Microsoft Security Bulletin MS02-041 *****]

    Voice:          +1 866-941-2472 (7 x 24)
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov/