Date: 28 July 1998
Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-98.120 -- CIAC Bulletin I-077
Mime Name Vulnerability in Outlook and Messenger
28 July 1998
===========================================================================
The U.S. Department of Energy Computer Incident Advisory Capability (CIAC)
has released the following advisory concerning a potential vulnerability
in Microsoft Outlook, Outlook Express, and Netscape Messenger (Mail). This
vulnerability may allow an attacker to execute arbitrary code on the victim
machine using the victim user's privileges.
Descriptions (but not exploitation details) of this problem have been made
public. At the present time we are unaware of any incidents exploiting
this vulnerability. However, we believe that the problem is serious and
that affected sites should address it as soon as possible.
AUSCERT previously released advisory AA-98.02 providing information and
workarounds only for the Microsoft Outlook and Outlook Express problem.
The following security bulletin is provided as a service to AusCERT's
members. As AusCERT did not write this document, AusCERT has had no
control over its content. As such, the decision to use any or all of this
information is the responsibility of each user or organisation, and should
be done so in accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It will
not be updated when the original bulletin is. If downloading at a later
date, it is recommended that the bulletin is retrieved from the original
authors to ensure that the information is still current.
If you have any questions or need further information, please contact CIAC
directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/Information/advisories.html
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for emergencies.
- ---------------------------BEGIN INCLUDED TEXT---------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_ /
\___ __|__ / \___
__________________________________________________________
ADVISORY BULLETIN
Mime Name Vulnerability in Outlook and Messenger
July 27, 1998 20:00 GMT Number I-077
______________________________________________________________________________
PROBLEM: A buffer overflow vulnerability has been identified in
Microsoft Outlook, Outlook Express, and Netscape Messenger
(Mail) that allows an e-mail or news message to contain
malicious code in a mime header. That code is executed when the
header is read by the e-mail/news reader. All of these
e-mail/news readers are widely distributed with popular
packages such as Internet Explorer, Windows 98, Windows 97,
Office 97, and Netscape Communicator.
PLATFORM: Any platform that runs the vulnerable e-mail/news readers:
Windows 95, Windows 98, Windows NT, Macintosh and Solaris.
DAMAGE: If exploited, this vulnerability allows a remote user to run
arbitrary code on a users machine with the user's privileges.
The remotely executed code could do anything from sending
thousands of e-mails in the user's name to formatting the hard
drive.
SOLUTION: Apply patches from Microsoft and Netscape.
______________________________________________________________________________
VULNERABILITY Risk is high. While we have not yet heard of anyone exploiting
ASSESSMENT: this vulnerability for malicious purposes, the ease with which
it can be exploited, the wide distribution of vulnerable
readers, and the potential for damage makes it a very serious
problem.
______________________________________________________________________________
Mime Name Vulnerability in Outlook and Messenger
CIAC has received information about a vulnerability in the Microsoft and
Netscape e-mail/news products: Outlook, Outlook Express, and Messenger (Mail).
These e-mail/news programs improperly handle the mime name tags used to
identify attachments to e-mail/news messages. An improper name tag can result
in a buffer overflow condition when the program processes the attachment. As
the reader generally processes the attachments when the user reads the
message, the buffer overflow condition can be initiated, by simply reading the
e-mail/news message.
The buffer overflow condition can then be exploited to run any arbitrary code
contained in the attachment. The code runs with the user's permissions to do
anything the user can do such as re-send the e-mail to the users mailing list,
change files, or format the hard drive.
While at first glance this appears to the Good_Times hoax come to life (see
http://ciac.llnl.gov/ciac/CIACHoaxes.html#goodtimes) this is not really the
case. Good_Times was supposed to run itself on any system that downloaded and
read the Good_Times message. This mime name vulnerability is caused by
improperly handled mime headers in a few versions of some very popular e-
mail/news readers. By replacing the vulnerable readers with properly patched
versions, this vulnerability is eliminated.
BACKGROUND
==========
The Multipurpose Internet Mail Extensions or MIME is a protocol for sending
non-ASCII text or multi-part documents as part of e-mail or news message.
Users of the readers rarely see the mime headers since they are stripped out
of the message as it is downloaded onto the user's machine. The mime headers
tell the reader where the different parts of the message begin and end, what
type of data is contained in the message part, what encoding is used to
convert the message, what the name of the file is that was attached as a
message part, and other information necessary for the successful transmission
of the data.
In the vulnerable readers, the headers are read into memory without checking
their length. When the length of the header is longer than the buffer in
memory where the reader tries to store it, data in the header beyond the
length of the buffer overwrites other code and data in memory. This
overwriting is the classic "buffer overflow" condition. If the overwritten
piece of memory is part of the running program, the code from the header in
the overwritten part is executed in place of the program's code.
ASSESSMENT
==========
As of the release date of this advisory, we have not heard of anyone
exploiting this vulnerability but we believe it to be extremely serious. Users
should take immediate action to patch vulnerable systems. We base this
assessment on the ease with which the vulnerability can be exploited, the
widespread use of the vulnerable e-mail/news readers, and the potential for
doing serious damage to a computer.
An additional, serious, long-term problem is the fact that these e-mail/news
readers are automatically installed on many systems along with web browsers,
office applications and operating systems. For example, Windows 98 comes
preinstalled on many new systems and contains one of the vulnerable readers.
As the installations are usually done from a CD-ROM, reinstalling a system in
the future for any reason reinstalls the vulnerable readers. Users must insure
that if they reinstall systems that they then replace the vulnerable readers
with appropriately patched versions.
VULNERABLE APPLICATIONS
=======================
Vulnerabilities in the following applications have been confirmed by the
manufacturers:
Outlook Express v4.72.2106.4 and v4.72.3110.1
Outlook '98
Netscape Messenger (Mail) v4.05, or 4.5b1
Earlier versions of these applications are also likely to be vulnerable. The
current version of Eudora does not appear to be vulnerable. Older e-mail
readers that do not handle mime attachments are not vulnerable.
PATCHES
=======
Information is available from Microsoft at:
http://www.microsoft.com/ie/security/oelong.htm
Patched versions of Outlook and Outlook Express are available from Microsoft
at the URL:
Outlook 98
http://support.microsoft.com/support/msfe
Request the patch OLMIME from Microsoft Support
Outlook Express
First update to Internet Explorer 4.01 at:
http://www.Microsoft.com/ie
Then obtain the patch from:
http://www.microsoft.com/ie/security/oelong.htm
Patches for Macintosh and Solaris versions of Outlook Express will be
available soon at:
http://www.Microsoft.com/security
Version 4.06 of Netscape Communicator is due out around August 7 and will
contain a patched version of the e-mail reader. Patches will be available
through their Smart Update web page:
http://home.netscape.com/download/su1.html
______________________________________________________________________________
A special thanks goes to Ari Takanen and Marko Laakso of the University of
Oulu in Finland and Russ Cooper the Owner/Moderator of the NTBugtraq mailing
list for finding and verifying this vulnerability.
______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@llnl.gov
For emergencies and off-hour assistance, DOE, DOE contractor sites,
and the NIH may contact CIAC 24-hours a day. During off hours (5PM -
8AM PST), call the CIAC voice number 925-422-8193 and leave a message,
or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two
Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC
duty person, and the secondary PIN number, 8550074 is for the CIAC
Project Leader.
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
(or http://ciac.llnl.gov -- they're the same machine)
Anonymous FTP: ftp.ciac.org
(or ciac.llnl.gov -- they're the same machine)
Modem access: +1 (925) 423-4753 (28.8K baud)
+1 (925) 423-3331 (28.8K baud)
CIAC has several self-subscribing mailing lists for electronic
publications:
1. CIAC-BULLETIN for Advisories, highest priority - time critical
information and Bulletins, important computer security information;
2. SPI-ANNOUNCE for official news about Security Profile Inspector
(SPI) software updates, new features, distribution and
availability;
3. SPI-NOTES, for discussion of problems and solutions regarding the
use of SPI products.
Our mailing lists are managed by a public domain software package
called Majordomo, which ignores E-mail header subject lines. To
subscribe (add yourself) to one of our mailing lists, send the
following request as the E-mail message body, substituting
ciac-bulletin, spi-announce OR spi-notes for list-name:
E-mail to ciac-listproc@llnl.gov or majordomo@tholia.llnl.gov:
subscribe list-name
e.g., subscribe ciac-bulletin
You will receive an acknowledgment email immediately with a confirmation
that you will need to mail back to the addresses above, as per the
instructions in the email. This is a partial protection to make sure
you are really the one who asked to be signed up for the list in question.
If you include the word 'help' in the body of an email to the above address,
it will also send back an information file on how to subscribe/unsubscribe,
get past issues of CIAC bulletins via email, etc.
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
I-067: AutoStart 9805 Macintosh Worm Virus
I-068: File Access Issue With Internet Information Server
I-069: Buffer overflows in some POP servers
I-070: Distributed DoS Attack Against NIS/NIS+ Networks
I-071: OpenVMS loginout Vulnerability
I-072: SunOS Solaris Vulnerabilities (libnsl, SUNWadmap)
I-073: multiscan ('mscan') Tool
I-074: Buffer Overflow in Some Implementations of IMAP Servers
I-075: Microsoft Office 98 Security Vulnerability
I-076: SGI IRIX ioconfig(1M) and disk_bandwidth(1M) Vulnerability
- -----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition
iQCVAwUBNbzLSLnzJzdsy3QZAQFf2gQAli0YHsRhVwyIM/uAHnF/4I/gfN2rrJ52
w+5xsToSqwktDwatMlI+M+4q3j9Q3xoPd4IzI/KA3ynd0yaIxz4Y0kbeVAdvlQCm
KagIofKEUXF6P/PnaVX3xMUS3Jxt/ZJgF7hEnBBzXNhCi/3llz6YLf3JH6KPV1CL
3zeTbiORrMk=
=uDaP
- -----END PGP SIGNATURE-----
- ---------------------------END INCLUDED TEXT-----------------------------
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBNcWIJyh9+71yA2DNAQFHLgP/S9/6pFeaRKzrrzsfsZco2Snr7gMKC8NO
7aU1hFS3bW9SnZf0OAIlwx0y8TpyeGu2dBnayZ28TMh6KGMhwg7ukY163oukolkn
EGoZbNRnbGFHX0CZ1L7gUOqsToyRCZzBNHH6Wazv+MMRrSqBz5AsPjEtW9u2/TjV
GxU4O15K09g=
=E+6o
-----END PGP SIGNATURE-----
|