Comments on "Assessing the risk of the February Security Bulletins"

I just read the "Assessing the risk of February Security Bulletins" blog post here http://blogs.technet.com/srd/archive/2010/02/09/assessing-the-risk-of-the-february-security-bulletins.aspx

I have some quick comments about the "SMB NTLM Weak Nonce" vulnerability we released and MS' risk assessment:

• The blog post says:"Likely to see working proof-of-concept in next 30 days for CVE-2010-0231 resulting in attacker luring remote victim user to open file on attacker server and initiating a connection back to machine where remote victim is logged on. "

We released fully working proof-of-concept code in our advisory (for two different 'approaches' to exploit the vulnerability) the same day the patch was released, so PoC is already available.

• MS calls this issue an 'Elevation of Privilege' vulnerability and 'Important'
  

(also mentioned here: http://blogs.technet.com/srd/archive/2010/02/09/ms10-006-and-ms10-012-smb-security-bulletins.aspx)

I discussed this with MS; they had their reasons which I understood but I disagree.

I'm not convinced this should be categorized as a 'remote code execution' vulnerability either, because strictly speaking.. it is not..

(although it can definitely be used to execute code remotely using DCE/RPC without user interaction, just change the PoC to, instead of creating a text file, do something similar to 'psexec', create exe+register service+start service=code execution. Code to do this is already available in metasploit. I'm going to release an improved version of the PoC with these changes, but you can easily do it yourself).

But, I feel 'Elevation of Privilege' is a term better suited to cases where you have some kind of access level (e.g.: regular user) and then you are able to *elevate* your privileges (.e.g.: you become an admin).

In this case you have no access.. and then you have access..

Following the same logic, a remotely exploitable buffer overflow (remote code execution) would also be an 'elevation of privilege' vulnerability.. :) you don't have access.. you exploit, now you do!..

Anyways... I understand it is perhaps hard to just pick the right 'class' for this vulnerability, and frankly, it doesn't matter..

I just want to say that if you are dismissing applying this patch because it is only an 'Elevation of privilege'.. and because http://blogs.technet.com/srd/archive/2010/02/09/ms10-006-and-ms10-012-smb-security-bulletins.aspx says that the severity of the four vulnerabilities included in ms10-012 is 'Important'.. I ask you to reconsider... :)

Anyways, like I said, 'Important' *should* be enough to convince you to apply the patch.. but just in case..

Also some comments about this vulnerability and Windows NT4:

if you still have some Windows NT 4 boxes on your network and they're accepting NTLMv1 auth requests and other Windows NT 4 boxes acting as clients are initiating authentication attempts using NTLMv1, your network might be vulnerable to replay attacks without any kind of user interaction. It *might* be possible for an attacker to passively sniff network traffic, collect challenges/responses, and then start making connections to the server until a previously observed challenge is returned and at that point return the corresponding response (to increase the feasibility of the attack, it will be a good idea to capture several challenge/response sessions, not just one.. :).. in fact, you could do more sophisticated attacks..)

This scenario is described in the advisory, but since Windows NT 4 is no longer supported by Microsoft, there's no patch. You'll need to do something else, like disabling incoming NTLMv1 auth attempts in Windows NT4 servers (if possible).