ENSRT Incident Note ETS-i-2006-12599
The Enterasys Security Response Team (ENSRT) publishes incident notes to provide information for our constituents to raise awareness of issues deemed threatening to the security and integrity of our customers.
US-CERT Vulnerability Note VU#181038
Release Date: 12/29/2005
Last Updated: 01/04/2006
Overview
Because of an error in handling files using the Windows Metafile image format, it has been determined that Microsoft Windows is vulnerable to remote code execution via publicly posted exploit code. This code has been utilized to successfully attack fully-patched Windows XP SP2 systems.
Systems affected
Windows operating systemsSystems not affected
Linux and MAC/OSXDescription
Microsoft Windows Metafile format images contain both vector and bitmap-based picture information. Within Microsoft Windows routines for displaying Windows Metafiles exist. However, a lack of input validation in one of these routines may allow a buffer overflow to occur, and can allow remote arbitrary code execution.
The previously mentioned public exploits use the Windows Picture and Fax Viewer (SHIMGVW.DLL) as an attack vector affecting users of any Windows-based application that can handle Windows Metafiles. Disabling the Windows Picture and Fax Viewer will not eliminate this vulnerability as it is currently thought to exist in the Windows Graphical Device Interface library (GDI32.DLL).
Threat Assessment
If a user is persuaded to view a specially crafted Windows Metafile, a remote, unauthenticated attacker may be able to execute arbitrary code on the user's end system. Currently there is no Microsoft patch available for this vulnerability.
Remediation
| Matrix N-Series | X |
| Matrix E7 | X |
| Matrix E6 | X |
| Matrix E5 | X |
| Matrix E1 | X |
| VH | X |
| C-Series | X | B-Series | X |
Detection
Several Internet sites have hosted a malicous .wmf file that is used to install a backdoor on compromised hosts. A Metasploit module has been made available as a public exploit. The Dragon MS:METAFILE-OVERFLOW2 signature has been created to detect this public exploit. This signature functions by analyzing Web traffic, however, this attack may be used on other ports such as e-mail or Windows File Share.
Additionally, numerous Trojans in the "NASCENE" family exploit the WMF vulnerability in an attempt to take control of vulnerable PCs. ENSRT has created the following family of Dragon signatures to detect the "NASCENE" Trojans during infection. These ENSRT signatures all have the prefix "ENSRT:WMF-VU181038". As additional worms and viruses exploiting the WMF vulnerability are detected in the wild, new ENSRT signatures will be added to "ENSRT:WMF-VU181038". These signatures should be utilized on a temporary basis until the forthcoming Microsoft patch has been deployed and successfully corrected the WMF vulnerability.
Prevention
Enterasys offers two forms of prevention:
1) The Enterasys Sentinel ™ solution is capable of monitoring various end system activities. Enterasys Sentinel ™ is able to take immediate action such as traffic filtering for IP addresses and TCP/UDP ports or placing the user into a Quarantine policy or VLAN until end system threat is mitigated.
2) In-line attack disruption can be achieved via the Dragon Intrusion Prevention System (IPS) to drop detected events before vulnerabilities can be exploited.
Containment
The Enterasys Secure Networks ™ solution can remove infected end-users from the enterprise network by detecting the infection with a Dragon NIDS signature (see "Detection" section of this report), locating the user's connection point using Automated Security Manager's location services module, and either placing the user in a quarantine VLAN or disabling the associated switch port for the user.
Repair
Monitor Dragon RealTime Console for alerts that end-user PCs have been exploited. If utilizing the DIR solution, users can either be expunged from the network or provided a quarantine policy.
References
http://www.kb.cert.org/vuls/id/181038
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FNASCENE%2EH
This document and the information contained herein are intended solely for informational use. Enterasys Networks, Inc. makes no representations or warranties of any kind, whether expressed or implied, with respect to this information and assumes no responsibility for its accuracy or completeness. Enterasys Networks, Inc. hereby disclaims all liability and warranty for any information contained herein and all the material and information herein exists to be used only on an "as is" basis. More specific information may be available on request. By your review and/or use of the information contained herein, you expressly release Enterasys from any and all liability related in any way to this information.
A copy of the text of this section is an uncontrolled copy, and may lack important information or contain factual errors. All information herein is Copyright ©Enterasys Networks, Inc. All rights reserved. All information above is subject to change without notice.
Revision History:
|
Version: 1.0 |
Date: 12/29/2005 |
Author: ENSRT STAFF |
Change |