[晕倒死] 98 me [叉P]请主意，重要安全补丁

真水ying

Title:      Unchecked Buffer in Universal Plug and Play can Lead
           to System Compromise
Date:       20 December 2001
Software:   [晕倒死] 98, [晕倒死] 98SE, [晕倒死] ME, [晕倒死叉P]
Impact:     Run code of attacker's choice
Max Risk:   Critical
Bulletin:   MS01-059
[M$] encourages customers to review the Security Bulletin at:
http://www.[M$].com/technet/security/bulletin/MS01-059.asp.
- ----------------------------------------------------------------------
Issue:
======
The Universal Plug and Play (UPnP) service allows computers to
discover and use network-based devices. [晕倒死] ME and [叉P]
include native UPnP services; [晕倒死] 98 and 98SE do not include a
native UPnP service, but one can be installed via the
Internet Connection Sharing client that ships with [晕倒死叉P] . This
bulletin discusses two vulnerabilities affecting these
UPnP implementations. Although the vulnerabilities are unrelated,
both involve how UPnP-capable computers handle the
discovery of new devices on the network.
The first vulnerability is a buffer overrun vulnerability. There is
an unchecked buffer in one of the components that handle
NOTIFY directives - messages that advertise the availability of
UPnP-capable devices on the network. By sending a specially
malformed NOTIFY directive, it would be possible for an attacker to
cause code to run in the context of the UPnP service,
which runs with System privileges on [晕倒死叉P] . (On [晕倒死] 98 and
[晕倒死] ME, all code executes as part of the operating
system). This would enable the attacker to gain complete control over
the system.
The second vulnerability results because the UPnP doesn't
sufficiently limit the steps to which the UPnP service will go to
obtain information on using a newly discovered device. Within the
NOTIFY directive that a new UPnP device sends is
information telling interested computers where to obtain its device
description, which lists the services the device offers
and instructions for using them. By design, the device description
may reside on a third-party server rather than on the
device itself. However, the UPnP implementations don't adequately
regulate how it performs this operation, and this gives
rise to two different denial of service scenarios.
In the first scenario, the attacker could send a NOTIFY directive to
a UPnP-capable computer, specifying that the device
description should be downloaded from a particular port on a
particular server. If the server was configured to simply echo
the download requests back to the UPnP service (e.g., by having the
echo service running on the port that the computer was
directed to), the computer could be made to enter an endless download
cycle that could consume some or all of the system's
availability. An attacker could craft and send this directive to a
victim's machine directly, by using the machine's IP
address. Or, he could send this same directive to a broadcast and
multicast domain and attack all affected machines within
earshot, consuming some or all of those systems' availability.
In the second scenario, an attacker could specify a third-party
server as the host for the device description in the NOTIFY
directive. If enough machines responded to the directive, it could
have the effect of flooding the third-party server with
bogus requests, in a distributed denial of service attack. As with
the first scenario, an attacker could either send the
directives to the victim directly, or to a broadcast or multicast
domain.
Mitigating Factors:
====================
General:
- Standard firewalling practices (specifically, blocking ports
  1900 and 5000) could be used to protect corporate networks
  from Internet-based attacks.
[晕倒死] 98 and 98SE:
- There is no native UPnP support for these systems. [晕倒死] 98
  and 98SE systems would only be affected if the Internet Connection
  Sharing Client from [晕倒死叉P] had been installed on the system.
- [晕倒死] 98 and 98SE machines that have installed the Internet
  Connection Sharing client from a [晕倒死叉P] system that has
  already applied this patch are not vulnerable.
[晕倒死] ME:
- [晕倒死] ME provides native UPnP support, but it is neither
  installed nor running by default. (However, some OEMs do
  configure pre-built systems with the service installed and
  running).
[晕倒死叉P] :
- Internet Connection Firewall, which runs by default, would make it
  significantly more difficult for an attacker to determine the IP
  address of an affected machine. This could impede an attacker's
  ability to attack a machine via unicast messages. However, attacks
  via multicast or broadcast would still be possible.
Risk Rating:
============
Buffer Overrun:
- Internet servers: None
- Intranet servers: None
- Client systems: Critical for [晕倒死叉P] , moderate for [晕倒死] 98,
  [晕倒死] 98SE and [晕倒死] ME
Denial of service:
- Internet servers: None
- Intranet servers: None
- Client systems: Moderate
Aggregate risk:
- Internet servers: None
- Intranet servers: None
- Client systems: Critical for [晕倒死叉P] , moderate for [晕倒死] 98,
  [晕倒死] 98SE and [晕倒死] ME
Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
  Security Bulletin at
  http://www.[M$].com/technet/security/bulletin/ms01-059.asp
  for information on obtaining this patch.
Acknowledgment:
===============
- eEye Digital Security (http://www.eeye.com)

碧海狂涛

哎呀！
怎么全是 E 文。

真水ying

哈！！1锻炼英语了！