Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Microsoft SSL Library Remote Compromise Vulnerability

Attack ID: CPAI-2004-19
Publish Date:
Last Update:
Category: Microsoft SSL Library Remote Compromise Vulnerability
Vulnerable Systems: Microsoft Windows 2000 up to and including SP4;
Microsoft Windows NT version 4 up to and including SP6a;
Microsoft Windows XP up to SP1
Source: CAN-2003-0719
SecuriTeam
Description: A remotely exploitable buffer overflow vulnerability exists in the Private Communications Transport (PCT) protocol, which is part of the Microsoft Secure Sockets Layer (SSL) library. The PCT 1.0 handshake contains a vulnerability that can lead to execution of arbitrary code with SYSTEM privileges.
Severity:
Details:

If any SSL-enabled services are present, and both the PCT 1.0 and SSL 2.0 protocols are enabled, remote attackers may exploit the buffer overflow condition to execute arbitrary code on vulnerable Windows server installations and gain SYSTEM privileges.

The severity of this vulnerability is compounded by the fact that SSL is most often used to secure communications involving confidential or valuable information, and it is therefore believed that hackers will aggressively target this vulnerability.

An available exploit sends a malformed SSL/PCT CLIENT_HELLO message, along with sufficient code that allows it to open a remote shell on the victim’s server. Once exploited, a remote shell is created on the target system on TCP port 31337.
Attack Detection: Using SmartView Tracker, users of VPN-1 NG AI R55 will be able to identify dropped logs with rule number 99443 displayed in the log viewer window.

InterSpect and R55W users will receive a SmartDefense log with the following entries:

Attack name: VPN Protection.
Attack Information: Malformed SSL packet detected.
Solution:

Users of VPN-1 NG AI R55 and InterSpect who haven't updated their VPN-1/FireWall-1 in accordance with CPAI-2004-13, should update their SmartDefense by pressing the Update Now button in the SmartDefense General tab.

To apply the protection (R55, R55W and InterSpect):

  1. From the SmartDefense menu, select Application Intelligence > VPN Protocols > Block SSL null-pointer assignment.
  2. Install policy on all modules.

As a best security practice, it is highly advised to block TCP high ports to prevent future security threats of this nature.
Industry Reference:
Additional Information: MS04-011