eEye Digital Security - Research Blog

DarumGrim Updated

Hi everyone.

You may have noticed that we removed the patch analysis on MS06-042.  We updated DarumGrim to version 1.0.3 and decided that the patch anlysis document is better suited in PDF format.

So, while we get that converted over to PDF and on to the site, check out the new version of DarumGrim here.

Post MS06-035 Mailslot DoS Workaround

SRVNODOS is a workaround for the unpatched SRV.SYS wcsnicmp null pointer dereference crash, which was publicized by Core Security Technologies following the release of the MS06-035 SRV Mailslot patch. SRVNODOS works by allocating memory at virtual address 0 within the System process, keeping the null pointer dereference from causing a blue-screen but otherwise not solving the underlying problem. The utility requires administrative or SYSTEM privileges in order to run successfully.

It is very unlikely but theoretically possible that the use of this utility could allow successful exploitation of other, as-yet unknown kernel null pointer dereference vulnerabilities, and it may be possible to achieve a denial of service even with this workaround applied.

Because of the low severity of the SRV denial-of-service issue, we recommend only using SRVNODOS on systems under active attack or systems for which uninterrupted up-time is paramount. The official hotfix should be installed once Microsoft makes it available, and use of this utility should be discontinued at that point.

You can download both the source and the compiled workaround  here.

More information is available here;

http://www1.corest.com/common/showdoc.php?idx=562

http://isc.sans.org/diary.php?storyid=1599

http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx

http://www.securityfocus.com/bid/19215

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3942

http://milw0rm.org/exploits/2057

Please note that we have performed minimal testing on this so use at your own risk.

Checking for Vulnerability to MS06-040

We thought we would say a quick word on how both our free scanner for MS06-040 and our remote Retina audit as some users have experienced issues scanning certain systems. The problem we've seen so far relates to the BROWSER pipe not existing and the other pipes requiring credentials, the latter of which (credentials required for SRVSVC and WKSSVC pipes) only exists on XP+. This means that non-existence of the BROWSER pipe on 2000 would be a non-issue, because we would fall back to SRVSVC and then WKSSVC. When using Retina, the non-existance of the BROWSER pipe is easy to resolve by simply using credentials which is something our free scanner does not support.

One note however, the current Malware abusing this flaw also requires the existence of the BROWSER pipe and the ability to anonymously connect to it. So if our free scanner is unable to check your system due to the non-existance of the BROWER pipe then the current Malware will be unable to as well. It is also important for users of Retina to understand that Retina, in addition to having the ability to use credentials, also has the standard patch type checks that can tell you what is and what is not patched.

I hope this clears up a bit of the confusion. If you have any questions or concerns feel free to email us at [email protected]

Botnet technical analysis...

If you have not already seen our alert previously for the current botnet/malware using MS06-040 as a propogation vector then here is more information:

http://research.eeye.com/html/alerts/AL20060813.html

-eEye Research

Automated malware out for MS06-040

Our honeypot network started firing off alerts mid-afternoon/evening on the 12th. The detection was triggered because of our Blink systems which were running on Windows 2000 with no patches installed except for service pack 4. The Blink IPS was set to block all attacks, except for the MS06-040 server service vulnerability. For this IPS protection was set to log only, that way our system could be infected and a full network capture and file trace could be performed. I wont bore you with all of the other details of the system... except that if your a University or have a large network and would like to be part of our growning group of Blink honeypot networks then contact [email protected] directly. But more on the automated malware that is spreading...

As mentioned previously the malware spreads by exploiting systems using the MS06-040 vulnerability which we previously "bloged about" and have also previously released a free scanning tool for. So far from the samples we have gathered the payload looks only to work on Windows 2000, which makes sense since most of the exploits released were more common for Win2k than other platforms.

Once the malware has infected your system it will setup a bot which sits on IRC and can be used by attackers to send commands to control your system to perform things such as DDoS attacks. This is typical functionality of any botnet style system.

Anyone who is using an IPS, such as Blink (its our blog, we will pimp our warez ;-)), is protected from this automated malware leveraging MS06-040. I think most IPSs should stop this attack by now, or i'd hope so.

For those of you though who are still sitting only depending on anti-virus your probably not in as much luck. When we first started to see the attacks come in we ran the malware components through a few anti-virus and this was the results:
McAfee 4827/20060811 found nothing
Microsoft 1.1508/20060804 found nothing
Kaspersky 4.0.2.24/20060813 found nothing
Symantec 8.0/20060813 found nothing
Sophos 4.08.0/20060812 found nothing
CA eTrust 23.72.94/20060812 found nothing

Not to beat a dead horse but lets just all say it again: Anti-Virus is completly reactive technology. But actually that is not fair because we are about to announce Anti-Virus within Blink and the technology we use generically detected these malware components without requiring any sort of updates. So not all Anti-Virus technology is reactive, just most of the major players are.

We will be posting more specifics later on but right now we wanted to make sure everyone recieved a quick heads up that there is an automated piece of malware out there right now targeting systems at "random."

The real important aspect with anything like this is just that this event creates a fire under everyones *** to make sure they have patched all of their systems... and again when i doubt, use our free scanning tool and find out.

-eEye Research