Original release date: November 21, 2002<br>
Last revised: --<br>
Source: CERT/CC<br>

<p>A complete revision history can be found at the end of this file.</p>

<a name="affected"></a>
<h3>Systems Affected</h3>

<p>All Microsoft Windows systems running the following:</p>
<ul>
<li>Versions of Microsoft Data Access Components (MDAC) prior to 2.7</li>
<li>Internet Explorer version 6</li>
<li>Internet Explorer version 5.5</li>
<li>Internet Explorer version 5.1</li>
</ul>

<p>Note that Microsoft Windows XP is shipped with MDAC version 2.7 and is
not vulnerable by default even though Internet Explorer 6.0 is installed.
</p>

<p>Because the normal operation of several applications and web
servers on a system depend on the proper operation of the MDAC ActiveX
control, other programs could be used as an exploit vector. For example, 
Internet Information Server may be configured to use MDAC.
</p>

<a name="overview"></a> 
<h2>Overview</h2> 

<p>A vulnerability in the Microsoft Data Access Components (MDAC)
could lead to remote execution of code with the privileges of the
current process or user.
</p>

<a name="description"></a>
<h2>I. Description</h2>

<p>Microsoft Data Access Components (MDAC) is a collection of utilities
and routines to process requests between databases and network
applications. A buffer overflow vulnerability exists in the Remote Data
Services (RDS) component of MDAC.
</p> 

<p>The RDS component provides an intermediary step for a client's request
for service from a back-end database that enables the web site to apply
business logic to the request. </p>

<p>According to <A
HREF="http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-065.asp">Microsoft's
Security Bulletin MS02-065</A>, a routine in the RDS component,
specifically the RDS Data Stub function, contains an unchecked buffer. The
RDS Data Stub function's purpose is to parse incoming HTTP requests and
generate RDS commands. This unchecked buffer could be exploited to cause a
heap overflow. </p>

<p> There are two ways in which this vulnerability can be exploited.  The
first involves an attacker sending a malicious HTTP request to a
vulnerable service, such as an IIS server.  If RDS is enabled, the
attacker can execute arbitrary code as the IIS server.  RDS is not enabled
by default on Windows 2000 and Windows XP systems.  It can be disabled on
other systems by following the advice in Microsoft's security bulletin.
</p>

<p>
The other way to exploit this vulnerability involves a malicious web
site hosting a page that exploits the buffer overflow in the MDAC RDS
stub through a client application, such as Internet Explorer.  Most
systems running Internet Explorer on operating systems other than
Windows XP are vulnerable to this attack.  The attacker is able to run
arbitrary code as the user viewing the malicious web page.
</p>

<p>Both web servers and client applications that rely on MDAC are
affected.  It is recommended that all users of Microsoft Windows 98,
Windows 98 SE, Windows ME, Windows NT 4.0, and Windows 2000
apply the 
<a href="http://www.microsoft.com/downloads/Release.asp?ReleaseID=44733">patch
(Q329414)</a>.  Windows XP users are not affected since MDAC 2.7, the
non-vulnerable version, is installed by default.</p>


<p>
Information about this vulnerability is discussed in <a 
href="http://www.kb.cert.org/vuls/id/542081">VU#542081</a>. This issue is 
also being referenced as <a 
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1142">CAN-2002-1142</a>.
</p>

<a name="impact"></a>
<h2>II. Impact</h2>

<p>A remote attacker could execute arbitrary code with the privileges
of the application that processed the request.</p>

<p>In the case of a web server or other service, this is likely to be the
SYSTEM or another account with elevated privileges. In the case of a
client application, this will be the account used to view the web page.
</p>

<a name="solution"></a> 
<h2>III. Solution</h2>

<h4>Apply a patch from your vendor.</h4>

Microsoft has released a <a
href="http://www.microsoft.com/downloads/Release.asp?ReleaseID=44733">patch
(Q329414)</a> and a <A
HREF="http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-065.asp">security
bulletin (MS02-065)</A> to address this issue. An end-user version of
MS02-065 is available at <a
href="http://www.microsoft.com/security/security_bulletins/ms02-065.asp">http://www.microsoft.com/security/security_bulletins/ms02-065.asp</a>.
</p>

<p> According to the Microsoft advisory, a scenario exists in by which a
vulnerable version of the control may be re-installed on a Windows system
even after the patch has been applied. This is due to the fact that the
vulnerable ActiveX control is signed by Microsoft and the patch does not
set the kill bit for the MDAC control. </p>


<hr noshade>

<p>This vulnerability was reported in an <a 
href="http://www.foundstone.com/knowledge/randd-advisories-display.html?id=337">advisory</a> 
by Foundstone and in <a 
href="http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-065.asp">MS02-065</a> 
by Microsoft. 
</p>
<hr noshade>

<p>Feedback can be sent to the Authors: <a
href="mailto:cert@cert.org?subject=CA-2002-33%20Feedback%20VU%23542081">Jason 
A. Rafail, Chad R. Dougherty, and Cory F. Cohen</a>.

<!--#include virtual="/include/footer_nocopyright.html" -->

<p>Copyright 2002 Carnegie Mellon University.</p>

<p>Revision History
<pre>
November 21, 2002: Initial release
</pre>
</p>