RE: Alert: MS03-019, Microsoft... wrong, again.

["Marc Maiffret" <marc () eeye com>]

Microsoft is wrong and misleading customers in this advisory. This Windows
Media Service vulnerability is exploitable, as confirmed in the labs at
eEye, and by the discoverer of this vulnerability, Brett Moore.

I am not sure why Microsoft misidentified this vulnerability... maybe it is
just a typo, maybe its a lack of technical know-how. Either way they need to
re-release this advisory so that the correct information is given to
customers.

There is a big difference in telling customers "Ahh its a denial of service,
and your web server will automatically restart" compared to the reality of
the situation "If your running Windows Media Services on IIS, attackers can
spawn a remote shell 'command prompt' on your vulnerable system."

Brett Moore, the researcher that discovered this flaw, is going to be
releasing an advisory soon with more details on the how and why.

Not sure how you can have "Trust"worthy Computing when your misinforming
customers on a regular basis or releasing patches that disable their
Internet access. :-o

For those technically inclined... supposedly MS thinks controlling ecx and
eax on a mov [ecx],eax is not exploitable, just a DoS. hah

Signed,
Marc Maiffret
Chief Hacking Officer
eEye Digital Security
T.949.349.9062
F.949.349.9538
http://eEye.com/Retina - Network Security Scanner
http://eEye.com/Iris - Network Traffic Analyzer
http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities

P.S. U.S. drinking team still rulez N.Z. >:-]

| -----Original Message-----
| From: Windows NTBugtraq Mailing List
| [mailto:NTBUGTRAQ () LISTSERV NTBUGTRAQ COM]On Behalf Of Russ
| Sent: Wednesday, May 28, 2003 10:30 AM
| To: NTBUGTRAQ () LISTSERV NTBUGTRAQ COM
| Subject: Alert: Microsoft Security Bulletin - MS03-019
|
|
| http://www.microsoft.com/technet/security/bulletin/MS03-019.asp
|
| Flaw in ISAPI Extension for Windows Media Services Could Cause
| Denial of Service (817772)
|
| Originally posted: May 28, 2003
|
| Summary
|
| Who should read this bulletin: System administrators running
| Microsoft® Windows NT 4.0 or Microsoft Windows 2000
|
| Impact of vulnerability: Denial of Service
|
| Maximum Severity Rating: Moderate
|
| Recommendation: System administrators install the patch at the
| earliest available opportunity.
|
| Affected Software:
| - Microsoft Windows NT 4.0
| - Microsoft Windows 2000Non Affected Software:
| -  Microsoft Windows XP
| -  Microsoft Windows Server 2003