-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2001.084 -- Microsoft Security Bulletin MS01-013
            Windows 2000 Event Viewer Contains Unchecked Buffer
                             27 February 2001

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Windows 2000 Event Viewer
Vendor:                 Microsoft
Operating System:       Windows 2000 Professional 
                        Windows 2000 Server
                        Windows 2000 Advanced Server
                        Windows 2000 Datacenter Server
Impact:                 Denial of Service
                        Execute Arbitrary Code/Commands
Access Required:        Existing Account

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------------
Title:      Windows 2000 Event Viewer Contains Unchecked Buffer
Date:       February 26, 2001
Software:   Windows 2000
Impact:     Run code of attacker's choice
Bulletin:   MS01-013

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-013.asp.
- - ----------------------------------------------------------------------

Issue:
======
The Windows 2000 event viewer snap-in has an unchecked buffer in a
section of the code that displays the detailed view of event records.
If the event viewer attempted to display an event record that
contained specially malformed data in one of the fields, either of
two outcomes would result. In the less serious case, the event viewer
would fail. In the more serious case, code of the attacker's choice
could be made to run via a buffer overrun.

By design, unprivileged processes can log events in the System and
Application logs, and interactively logged-on, unprivileged users can
view them. However, only privileged processes can log events in the
Security log, and only interactively logged-on administrators can
view them. If the vulnerability were exploited to run code of the
attacker's choice, the code would run in the security context of the
user who viewed the affected record.

Mitigating Factors:
====================
 - Simply perusing the listing of events in a log would not allow
   the vulnerability to be exploited. It could only be exploited
   if the user opened an affected record to view the event details.
 - Although the Event Viewer is generally thought of as an
   administrative tool, there is no guarantee that the user who opens
   a particular event record would be privileged. Unprivileged users
   can read the System and Application logs. Although the Security
   log can only be read by privileged users, only privileged
   processes can write to it.
 - To the best of our knowledge, it is not possible to manipulate
   the normal auditing functions of any Windows 2000 service in order
   to create an event record that would exploit this vulnerability.
   Instead, a custom piece of code would need to be created and run
   to create such a record.
 - If firewalling and other appropriate precautions have been taken,
   only authenticated users will have access to network machines and
   be able to write event log records.

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the
   Security Bulletin
   http://www.microsoft.com/technet/security/bulletin/ms01-013.asp
   for information on obtaining this patch.

Acknowledgment:
===============
 - Blake Watts of Guardent (http://www.guardent.com)

- - ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.



- -----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3

iQEVAwUBOprQmY0ZSRQxA/UrAQGGpgf/ZxvSC+9sp7ThlvyNkgNjyIG6QqieegtC
K/5VbqsA2JtvSOYFOVXUG/JJIsDhFCumXGt33RJX83mAMgqSDYCXmO+17UrXqr5w
HLNX4BNLyx/nlEATXVj3/fiz55XYCVNCXFgIlZ7xYP1PvfTKGfEsK8wkkmLlSZDo
fDFGCXcEFX8CCAhwnDiMPCfI7yXPll33e2Tad2Zd067zOGr+WXuLHC3x9blQL7WE
QjcSaxCeVawHA2UtoI7zEZvnynZrpfHCQK3iL/A73tOiArvATS4AjaSA3iqMGrYS
POGcgTPTaUeZUbdIxTa17cb7fiwjmntYZ/tIYuumIVeaLaqjPi7sxA==
=/a0Y
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOpvarih9+71yA2DNAQGpDwQAgL7GfcoCgDlziGrW5E7PyOa36PCu3nXo
WSPmXHW6l/rV8BTZ+nG+5ykdZSZPxgv5wq36C3aRjlD4gY9l7scjr2ANeMbtEvJN
TIbGUAo5t8nNwoM5hfrvCpZfpT+Bqj0bYh0atLbdlyWkIfDBk0CX1dRDlohsbM8N
NOwgV6weWJw=
=L6og
-----END PGP SIGNATURE-----