Ms03-39

Only one security announcement from MS today...

MS03-39- basically an updated patch for the RPC buffer overflow issues.

Title: Buffer Overrun In RPCSS Service Could Allow Code Execution
(824146)
Date: September 10, 2003
Software: Microsoft Windows NT Workstation 4.0; Microsoft Windows NT
Server(r) 4.0; Microsoft Windows NT Server 4.0, Terminal Server Edition;
Microsoft Windows 2000; Microsoft Windows XP; Microsoft Windows Server
2003
Impact: Run code of attacker's choice
Maximum Severity Rating: Critical
Bulletin: MS03-039

The Microsoft Security Response Center has released Microsoft Security
Bulletin MS03-039

What Is It?
The Microsoft Security Response Center has released Microsoft Security
Bulletin MS03-039 which concerns a vulnerability in the versions of
Microsoft Windows listed above.

Microsoft has released a tool that can be used to scan a network for the
presence of systems which have not had the MS03-039 patch installed.
More details on this tool are available in Microsoft Knowledge Base
article 827363. This tool supersedes the one provided in Microsoft
Knowledge Base article 826369 which was developed to scan systems for
the vulnerability patched by MS03-026.

More information is now available at
http://www.microsoft.com/technet/sec...n/MS03-039.asp

In an effort to better communicate with our customers, Microsoft will
also be conducting a Webcast to provide guidance on Protecting Your PC
and details of MS03-039.
http://www.microsoft.com/usa/webcasts/upcoming/2373.asp

If you have any questions regarding this alert please contact your
Technical Account Manager.

Good ta know, thanks.


-Maestr0

At this moment, several underground groups are racing to get a worm out into the wild. For all of you who just went through the blaster worm remediation process, get ready for part II. I'd advise all of your admins to get patching ASAP.

As for me, it will be a late night as I have to coordinate the distribution and certify yet another MS patch.

Dammit!

Also, as posted on NTBugtraq. If you apply the MS03-039 patch and run the scanner for MS03-026 the scanner will say that you have not applyed the MS03-026 patch.

Here we go again.. say hello to all those PCs you visited just the other week.

It'd be nice if we'd been able to finish up from the RPC hole. And if we weren't constantly patching these MS products, maybe we'd be able to look at the automated deployment we need so much!

CXGJarrod, you posted:

Quote:

---

Also, as posted on NTBugtraq. If you apply the MS03-039 patch and run the scanner for MS03-026 the scanner will say that you have not applyed the MS03-026 patch.

---

The Technet article on this one says that this situation is true, that scanners that scan for MS03-026 will not detect it being patched if you have this new patch only applied. Microsoft has a new scanner out that will detect both patches.

Here is what Microsoft has to say on this:

Quote:

---

Microsoft has released a tool that can be used to scan a network for the presence of systems which have not had the MS03-039 patch installed. More details on this tool are available in Microsoft Knowledge Base article 827363. This tool supersedes the one provided in Microsoft Knowledge Base article 826369. If the tool provided in Microsoft Knowledge Base Article 826369 is used against a system which has installed the security patch provided with this bulletin, the superseded tool will incorrectly report that the system is missing the patch provided in MS03-026. Microsoft encourages customers to run the latest version of the tool available in Microsoft Knowledge Base article 827363 to determine if their systems are patched.

---

Basically, I am just gonna sit in a corner and cry for a while. I personally patched 120 machines for this previously, and now I get to do it again!

Guys, Just wanted to know two things.

If any of you guys would like to share a testing process for patches (other than the one MS reccomends)

If anyone out there knows of any repercussions by this patch, PLEASE POST FOR THE SAKE OF OTHERS.................

Thanks,

No test like production :)

Seriously....we have over 5000 units, probaby 3k with XP. And while we're pretty good to go at the firewall, we got hit bad over the head by laptop users plugging into our network.

Our desktop/helpdesk [under]staff[ed] just could not react quick enough. We're still recovering from the 1st round.....

We don't test....we DO. And hope for the best.

Sometimes it is best to throw a patch out into the production world if you know that others have successfully installed the patch or if you see other companies getting hit with the vulnerability. Microsoft reccomends that you test a patch in a test environment for at least two weeks before implementing into a production environment. I don' remeber where that article is, but i'm sure that it is easy to find. Here is a link that compares Hotfixes to Service packs if anyone is interested.
http://www.microsoft.com/technet/tre...s/srvpatch.asp
Thanks for the input.

Yeah, I know you are supposed to test patches and updates. Normally, we do. However, in my environment (this is a horror story for another time), we just don't have the luxury of time and resources to run a two week test on a critical update while the production servers are hanging out with their collective fly open. We almost got caught on a zero-day once before and we can't afford to risk it again.

We run a pretty vanilla shop with standard server and desktop hardware. So there are a minimal number of possible incompatible applications or systems that may be affected by the application of a critical patch or update. Our stance on vendor apps is that if a critical patch is applied and the app fails, it is placed off-line until the vendor fixes it. Security first.

Roll-ups, SRs and such are checked out as best we can prior to putting into production. We also don't try to do too many things at once, especially on the servers. Again, time and resources play into these decisions, but the overriding criteria is security.

We actually ran this RPCSS patch last night on all the servers. Everything seems to be fully functional and running smoothly this AM. The main thing, I think, is to keep the whole current. Not current in just the security patches, but the firmware, BIOS, the drivers, OS updates, all that.

Fraggin- I haven't seen anything negative come out of this patch yet. Spent all of last night patching a whole crap load of systems without a single problem.

As for verifying patch installation. I would not rely on the MS tools. Most of the time they are just looking to see if the installer program put the proper reg keys in place. What I like to do is open up the fix and get the date/version of all of the files included in the fix.

I then write a simple batch file that will go out to all of the servers that I upgraded and verify that the date/version of the hotfix files on the server match what is new from the hotfix.

That is about the only way to 100% verify that a hotfix has been installed. I have seen instances where for whatever strange reason 1 file would not be upgraded, so we implemented this process for all hotfix installs.

I started patching some "non-critical" machines last night. I checked their Event Viewer logs after the reboot, and there was nothing abnormal. Full functionality was available. I ran this on an IIS web server, a file and print server, and a few workstations.

Today, I am patching machines at a DR site for my company. I've patched a SQL 2k server, more file and print machines, and several machines running Lotus Domino. No problems here either.

So for me at least, the patch looks ok.

MS is sending this newsletter out to anybody that subscribes to any of their lists.


Dear IT Professional,

We are contacting you today to make you aware that we have released Microsoft Security Bulletin MS03-039 today, September 10, 2003. This bulletin details three critical vulnerabilities in the Windows operating system and provides instructions for applying the corresponding patch. While there is currently no active exploit of this vulnerability, if successfully exploited, these vulnerabilities would allow an attacker to gain control of the target system.

We strongly encourage you to obtain and deploy this patch to any affected system that connects to your infrastructure; this includes systems on your local area network and remote or mobile systems. For the most current information on affected systems and recommended remediation steps, please read the bulletin posted at: http://www.microsoft.com/technet/sec...n/ms03-039.asp

We understand the potential effect this situation and the recommended remediation steps may have on you. Microsoft is committed to providing you with information and tools to help run your enterprise safely and reliably on an on-going basis. When we become aware of vulnerabilities, it is our goal to quickly share protection and remediation information and work in partnership with you to eliminate these kinds of threats to your business. In order to help protect your computing environment from security vulnerabilities, we strongly encourage you to visit http://www.microsoft.com/technet/security/protect and implement the following three steps in your enterprise:

1. Verify firewall configuration. Audit Internet and intranet firewalls to ensure they comply with your security policy; these are your first line of defense. In addition, evaluate using host-level firewalls such as the Internet Connection Firewall in Windows XP. This is especially important for systems such as laptops and home PCs that connect to your network remotely.

2. Stay up to date. Use update services from Microsoft to keep your systems up to date. These services include three main components.

. Automatic Updates, available on Windows XP, Windows 2000 SP3 and SP4, and Windows Server 2003. Automatic Updates works with the Windows Update Web site to automate the process of updating Windows systems.

. Software Update Services (SUS), a patch-distribution server available for download from our Web site. SUS enables you deploy a server in your enterprise that Automatic Updates clients will use to get only approved and tested patches.

. Systems Management Server (SMS) is a flexible, enterprise-wide software update and systems management product.
In addition to using these update services, we strongly recommend that you subscribe to Microsoft's free security notification service at http://www.microsoft.com/securitynotification, so that you are proactively kept aware of new security issues.

3. Use and keep antivirus software up-to-date. Antivirus software programs will help protect your systems against viruses and other malicious code. To protect your systems from new viruses, it's also important to obtain up-to-date antivirus signatures through a subscription service from the antivirus software vendor. You should not let remote users or laptops connect to your network unless they have up-to-date antivirus software installed. In addition, consider using antivirus software in multiple points of your computer infrastructure, such as on edge Web proxy systems, as well as on email servers and gateways.

You should also protect your network by requiring employees to take the same three steps with home and laptop PCs they use to remotely connect to your enterprise, and by encouraging them to talk with friends and family to do the same with their PCs. To make this easier, we have set up a new Web site to assist PC users at http://www.microsoft.com/protect.

Again, we want to encourage you to read this security bulletin and deploy the patch to your systems. We want to thank you for your patience and work with you to protect your business from these kinds of security threats.



Thank you,

Microsoft Corporation



For information about Microsoft's privacy policies, please go to http://www.microsoft.com/info/privacy.htm

Microsoft put out this security alert on 10th Sept, but according to the following URL, the vulnerability was already disclosed by a Chinese Security group in July... interesting.. isn't it?

http://xforce.iss.net/xforce/alerts/id/152

And the article reports that an exploit is already out... (Anyone got hit yet??)

-Scim

The 'sploit that the x-force group is referring to is the DoS portion of MS03-039. Yes, that has been known since 6/21 to be in the wild. It cannot easily be turned into a worm, but it could be used as a payload for a worm.

the exploits that we're waiting for, although we dont want, are the exploits for the 2 BoF's in MS03-039. They have yet to be found in the wild.

Exibar

Our plan for this patch is really the same as the last patch..

[list=1][*]Start with patching the office-based client PCs. These are simple low-risk systems and shouldn't cause much trouble, aim to cover them in a couple of days.[*]Then recall all remote laptops (assuming you can't patch remotely) immediately giving a two week window for the equipment to come in.[*]If you have remote sites with no IT support, prioritise them by most business critical location first. Patch all PCs and servers at remote sites in one go.[*]Patch centrally located servers running standard software.[*]Finally, look to servers running esoteric or obscure services. You'll probably want to patch these last, because that will give you a greater opportunity to back out and fix any problems with the vendor (i.e. you might not want to be the first to try patching your platform and losing a business critical system).[/list=1]

That's only a rough order. Basically, you need to patch everything you can lay your hands on as the opportunity arise.

OK.. that's what to do if everything goes according to plan, but if you're a large organisation with sparse resources it's likely that you won't get 100% done by the time the worm hits, so plan for this too.

• In the event of a worm being released, bring the server patching forward and do it as soon as possible for all systems.
• Ensure that you have a packet sniffer running on your local network, in conjunction with information gleaned from your favorite security resources to find if you have been infected. Use a port scanner where appropriate. Ensure that anti-virus patches are loaded immediately.
• If the worm enters your network, or you deem that this is likely you will need to have the business agree that you can take emergency action (get the agreement in advance). This will mean that unpatched equipment should be disconnected from the network, so bar any unpatched laptops from dialling in and consider blocking traffic to and from remote unpatched sites until the threat subsides or a patch can be applied.

There are further steps you can take to mitigate the risk.

• Warn all users to ensure that no equipment is used outside the corporate firewall and then brought in. This is the most common way for a worm to get past the firewall.. somebody simply walks past it with an infected laptop. It might be worth getting agreement from the business so that harsh disciplinary action will be taken against violators. I would suggest that anybody who infects the coporate network despite being warned should be fired.
• Make sure all desktop PCs are switched off when not in use. This is a simple way of limiting the spread of an infection and could well enable you to contain a problem before it gets serious.
• Keep a constant eye on news sources (the Internet Storm Center is probably the best, but also AntiOnline, Slashdot etc) so that you know what's going on. Check when you get up in the morning. Check every hour or so at work. Check when you get home. Check when you go to bed. When the worm hits, get as much information as you can and then implement your agreed contigency plan if it seems necessary.

OK, that's a lot of stuff. If you weren't doing something similar for the RPC-1 hole then now is the time to look at this level of planning for the RPC-2 hole.

I personally think the the RPC-2 exploit is going to be nastier, faster spreading and generally more difficult to control than MSBlast and Nachi. And also I reckon that there's a window of about three weeks absolute max to get this done.

Enjoy patching!