AOL Admin backdoor for Windows allows remote attackers to control AOL actions

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorAolAdmin
Platforms: | Trojan Horse: Windows
Description: | AOL Admin is a backdoor for Windows 9x and NT that allows a remote attacker to connect to your computer and execute and delete files, send Instant Messages to an AOL user, monitor Instant Messages that you receive, and send mail from your AOL account.
Remedy: | Using Regedit, find the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Look for a value named "dat92003" with the value "dat92003.exe". Remove that registry entry and delete "dat92003.exe" from your Windows system directory.
References: |


Backdoor2 for Windows allows remote access to infected machines

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorBackdoor2
Platforms: | Trojan Horse: Windows
Description: | Backdoor2 is a poorly written trojan horse for Windows 9x/NT. This trojan horse allows a number of remote operations to be performed on the infected hosts and poses a significant threat.
Remedy: | Using RegEdit, look for the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run\, and a value named "Notepad" with the data "C:\WINDOWS\notpa.exe /o=yes". Delete this value, and then delete notpa.exe from C:\WINDOWS.
References: |


Blazer5 backdoor for Windows 9x/NT allows remote system access

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorBlazer5
Platforms: | Trojan Horse: Windows
Description: | The Blazer5 backdoor for Windows 9x and NT allows remote attackers to access the file system and registry of infected machines.
Remedy: | Using Regedit, find the following key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Look for a value named "Load MSchv32 Drv" with the value "c:\windows\system\mschv32.exe". Remove that registry entry and delete mschv32.exe from your Windows system directory.
References: |


Back Orifice 2000 allows complete remote administrative control of compromised machines

Risk Level: High risk vulnerability High

Check or Attack Name: BackdoorBo2k
Platforms: Trojan Horse: Windows
Description:

Back Orifice 2000 is a remote administration tool, or 'trojan horse,' designed to allow the remote operation of infected Windows 9x and Windows NT machines. This program was designed with stealth in mind, and as such is very difficult to detect with scanning, cleansing, and intrusion detection tools.
Remedy:

Contact your anti-virus vendor for updates to allow the automatic cleanings of systems infected with Back Orifice 2000.
References:

Microsoft Security Bulletin, What Customers Should Know About 'BackOrifice 2000', http://www.microsoft.com/security/bulletins/bo2k.asp

Cult of the Dead Cow, Back Orifice 2000, http://www.cultdeadcow.com/tools/bo2k/pr19990702.html

ISS Security Advisory #31, Back Orifice 2000, http://xforce.iss.net/alerts/advise31.php3

Trend Micro Security Alert, Back Orifice 2000, http://www.antivirus.com/vinfo/security/sa071299.htm

Symantec AntiVirus Research Center, BackOrifice2K.Trojan, http://www.norton.com/avcenter/venc/data/back.orifice.2000.trojan.html


Coma backdoor allows complete administrative control of infected machines from remote

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorComa
Platforms: | Trojan Horse: Windows
Description: | Coma is a backdoor for Windows 9x that allows a remote attacker to take control of a system once it has been infected. Control includes allowing the attacker to retrieve system information, execute programs, use FTP to transfer files, and log keystrokes.
Remedy: | Using RegEdit, look for the key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\, and find a value named "RunTime" with the data "C:\windows\msgsrv36.exe". Delete this value, then delete msgsrv36.exe from c:\windows.
References: |


Deltasource backdoor for Windows allows remote access to system files

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorDeltasource
Platforms: | Trojan Horse: Windows
Description: | The Deltasource backdoor for Windows 9x allows a remote attacker to access files, access your system registry, and execute programs, as well as several other features.
Remedy: | Using RegEdit, look for the key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\, and find a value named "DS admin tool" with the data "C:\somepath\server.exe". Delete this value, then delete Server.exe from from the path named in the registry value.
References: |


Doly backdoor for Windows allows remote access to files and keystrokes

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorDoly15
Platforms: | Trojan Horse: Windows
Description: | Doly is a backdoor for Windows 9x and NT that allows remote attackers to connect to your computer over the Internet and log your keystrokes, start an FTP server, capture your screen, and shut down or reboot your computer.
Remedy: | Using Regedit, find the following key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Look for a value named "Ms tesk" with the value "c:\program files\mdm.exe". Remove that registry entry and delete mdm.exe from your Program Files directory. Also remove the file Mdm.exe from your Startup folder in your Start menu.
References: |


EvilFTP is a backdoor FTP server

Risk Level: | High risk vulnerability High | Check or Attack Name: EvilFTP Backdoor
Platforms: | Trojan Horse: Windows
Description: | When the program containing the trojan is run, EvilFTP installs an FTP server on port 12346 with the login "yo" and the password "connect." This allows a remote user to upload and download files from the system on which the trojan was installed.
Remedy: | To remove EvilFTP in Windows 9x, open win.ini and delete the line run=c:\windows\system\msrun.exe. In Windows NT, this is stored in the registry. Find HKCU\Software\Microsoft\Windows NT\Windows\run=msrun.exe. Remove msrun.exe from your Windows System directory.
References: |


Forced Entry backdoor allows remote registry access and interactive login sessions

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorForcedentry
Platforms: | Trojan Horse: Windows
Description: | Forced Entry is a backdoor for Windows 9x that allows a remote attacker to access the registry and files on infected systems. This backdoor also allows telnet sessions into the machine, which negates the need for a client on the attacker's end.
Remedy: | Open C:\Windows\WIN.INI and look for the line "run=msreg32.exe". Remove that line, and delete msreg32.exe from C:\Windows\System.
References: |


Frenzy backdoor for Windows 9x allows remote attackers to control the behavior of infected systems

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorFrenzy
Platforms: | Trojan Horse: Windows
Description: | The Frenzy backdoor, once installed on a system, allows a remote attacker to perform actions like opening and closing the CD-ROM tray, making your computer beep, hiding your task bar, moving your mouse, and restarting your computer.
Remedy: | Using RegEdit, find the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Look for the value named "Explore", with the data "C:\Windows\Msgsrv36.exe". Remove that registry entry and then delete Msgsrv36.exe from C:\Windows.
References: |


GateCrasher is a standard backdoor that includes chatting and rebooting on the infected machine

Risk Level: | High risk vulnerability High | Check or Attack Name: GateCrasher Backdoor
Platforms: | Windows NT, Windows 95, Windows 98, Trojan Horse: Windows
Description: | GateCrasher 1.2 has the standard backdoor features, including starting and stopping an FTP server on your machine, rebooting your machine, and chatting with users on the system. GateCrasher 1.2 works on Windows 95, 98, and Windows NT.
Remedy: | GateCrasher listens for connections on port 6969. To determine if a machine is running GateCrasher, telnet to port 6969 and look for this banner: GateCrasher v1.2, Server On-Line... If you type 'gatecrasher;' (no quotes) and press Enter, it will return 'Access Granted...'. If you then type 'uninstall;' and press Enter, the server will be uninstalled. The server is still running, but you can kill it by typing 'end;' and pressing Enter.
References: | ISS Security Advisory #30, Windows Backdoor Update III, http://xforce.iss.net/alerts/advise30.php3


GirlFriend backdoor has ability to retrieve passwords

Risk Level: | High risk vulnerability High | Check or Attack Name: GirlFriend Backdoor
Platforms: | Windows 95, Windows 98, Trojan Horse: Windows
Description: | GirlFriend has standard backdoor features, as well as the ability to retrieve your passwords. This backdoor retrieves passwords by monitoring the password fields in dialog boxes on your screen and then saving the passwords. GirlFriend only works on Windows 95 and 98.
Remedy: | To remove GirlFriend from your machine, open regedit to HKLM\Software\Microsoft\Windows\CurrentVersion\Run and look for a value named "Windll.exe" with the data "c:\windows\windll.exe". Reboot to DOS and delete the C:\windows\windll.exe file, and then boot to Windows and remove the "Windll.exe" registry value.
References: | ISS Security Advisory #30, Windows Backdoor Update III, http://xforce.iss.net/alerts/advise30.php3


Hack'a'Tack backdoor allows attackers to manipulate windows on your desktop

Risk Level: | High risk vulnerability High | Check or Attack Name: Hack'a'tack Backdoor
Platforms: | Windows 95, Windows 98, Trojan Horse: Windows
Description: | Hack'a'Tack is a backdoor that allows attackers to move and kill windows on your desktop, open an FTP server on your machine, log keystrokes, save passwords you type, shut down the machine, and upload, download, and execute files. Hack'a'Tack only runs on Windows 95 and 98.
Remedy: | To remove Hack'a'Tack, open Regedit to the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key and look for a value named "Explorer32" with the data "C:\windows\Expl32.exe". Boot to DOS and delete the C:\Windows\Expl32.exe file, and then reboot into Windows and delete the "Explorer32" registry value.
References: | ISS Security Advisory #30, Windows Backdoor Update III, http://xforce.iss.net/alerts/advise30.php3


HackersParadise backdoor allows remote access to Windows 9x/NT

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorHackersparadise
Platforms: | Trojan Horse: Windows
Description: | The Hacker's Paradise backdoor can allow a user to access files on your hard drives, access your desktop, and retrieve your RAS passwords in Windows NT.
Remedy: | On the infected machine, kill the Antihack.exe process. In Windows 9x, press CTRL+ALT+DEL to bring up the task list to kill the process. In NT press CTRL+ALT+DEL, then click the "Task Manager" button to bring up the Task Manager.
References: |


Hvlrat backdoor for Windows allows a remote attacker to take control of the system's AOL sessions

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorHvlrat
Platforms: | Trojan Horse: Windows
Description: | The HVL-RAT backdoor for Windows allows remote attackers to take control of a user's America Online session. It will also stream audio from your microphone to the attacker and reboot or shut down your machine, but most of its features are based on AOL, such as spying in chat rooms and reading your instant messages. When HVL-RAT starts, it will send e-mail to rattest@yahoo.com giving away your IP address, and your AOL username and password.
Remedy: | Using Regedit, find the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Look for a value named "Explorer" with the value "C:\Windows\system\msgsvr16.exe". Remove that registry entry and delete MsgSvr16.exe from your Windows system directory.
References: |


Millenium backdoor allows remote attackers to log keystrokes and execute programs

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorMillenium
Platforms: | Trojan Horse: Windows
Description: | The Millenium backdoor for Windows lets a remote attacker spy on user activities by logging keystrokes and taking screen captures, as well as executing programs and sending messages to the user.
Remedy: | Using RegEdit, locate the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and look for the value named "Millenium" with the value "C:\windows\system\reg66.exe". Remove that registry entry and delete C:\Windows\System\reg66.exe.
References: |


NetMonitor backdoor for Windows 9x/NT allows remote access to system registry and files

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorNetmonitor
Platforms: | Trojan Horse: Windows
Description: | NetMonitor is a backdoor for Windows 9x/NT that allows an attacker to have remote access to your file system, registry, and desktop. In addition to these functions, the program also allows an attacker to send messages to the console and shut down the system.
Remedy: | Using Regedit, find the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and look for the value named "netspy" with the data "netspy.exe". Delete that value. Then, find netspy.exe in your Windows System directory (C:\Windows\System in 95 and 98, C:\Winnt\System32 in NT) and delete that.
References: | Sirius Software, Netspy, http://www2.crosswinds.net/china/~netspy/


NetSphere backdoor operates with ICQ

Risk Level: | High risk vulnerability High | Check or Attack Name: NetSphere Backdoor
Platforms: | Windows NT, Windows 95, Windows 98, Trojan Horse: Windows
Description: | NetSphere is a backdoor that performs the standard backdoor functions, including logging keystrokes, setting up a port redirector, capturing screenshots, and several functions to operate with Mirabilis ICQ. NetSphere works on Windows 95, 98, and Windows NT.
Remedy: | To remove NetSphere from your computer, telnet to port 30100 and type '' (with no quotes) and press Enter. You will be disconnected, and the server will no longer be installed on the target machine.
References: | ISS Security Advisory #30, Windows Backdoor Update III, http://xforce.iss.net/alerts/advise30.php3


Phase Zero backdoor for Windows 9x/NT allows complete control of a system and the ability to automatically trash the server

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorPhasezero
Platforms: | Windows NT, Windows 95, Windows 98, Trojan Horse: Windows
Description: | Phase Zero has all of the standard backdoor features, including the ability to upload and to download files to the computer using FTP, execute programs, delete and move files, and read and write to the registry. There is also a 'Trash Server' function that will delete all files from your Windows system directory. Phase Zero runs on Windows 95, 98, and Windows NT.
Remedy: | The registry value used by phAse Zero to start at boot is easily configurable, but is always in HKLM\Software\Microsoft\WindowsCurrentVersion\Run. The default name is "MsgServ"" and the value is "msgsvr32.exe". If you see any suspicious files in the Run key, locate the file mentioned (either in C:\Windows or C:\Windows\System in Windows 95 and 98, or C:\Winnt or C:\Winnt\System32 on Windows NT) and open it in Notepad. Search for the text "phAse Zero". If you find this text in the executable, then your system is infected with the phAse Zero backdoor, and you should delete that file and delete the registry value from the registry.
References: | ISS Security Advisory #30, Windows Backdoor Update III, http://xforce.iss.net/alerts/advise30.php3


Progenic backdoor for Windows 9x/NT allows remote access and can interact with ICQ

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorProgenic
Platforms: | Trojan Horse: Windows
Description: | The Progenic Trojan backdoor for Windows 9x and NT can get user passwords, open and close your CD-ROM drive, reboot or shut down your computer, and record your keystrokes. It also has functions to interact with Mirabilis' ICQ chat system.
Remedy: | Using Regedit, find the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Look for a value named "Scandisk" with the value "C:\Windows\scandiskwr.exe", or a value named "Kernel32" with the value "C:\Windows\scandiskc.exe". Remove the registry entry and delete "scandiskwr.exe" or "scandiskc.exe." Also open the file WIN.INI in your Windows system directory and delete the line containing "run=C:\Windows\scandiskc.exe" if it exists.
References: |


Prosiak backdoor allows remote access to files and the ability to setup anonymous proxies

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorProsiak
Platforms: | Trojan Horse: Windows
Description: | The Prosiak backdoor for Windows 9x allows a remote attacker to access files on your hard drive, set up a proxy on your machine to redirect network traffic, read and copy text to your clipboard, and shut down or reboot your computer.
Remedy: | Using Regedit, find the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices. Look for a value named "Microsoft DLL Loader" with the value "windll32.exe". Remove that registry entry and delete Expl32.exe from your Windows system directory.
References: |


Schwindler backdoors for Windows 9x allows remote access to files and user's keystrokes

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorSchwindler
Platforms: | Trojan Horse: Windows
Description: | The Schwindler backdoor for Windows 9x allows a remote attacker to access files on your hard drive, capture your keystrokes, and get passwords stored on your computer. This backdoor was based on the GirlFriend backdoor and has almost identical functionality.
Remedy: | Using Regedit, find the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Look for a value named "User.exe" with the value "C:\Windows\user.exe". Remove that registry entry and delete User.exe from your Windows system directory.
References: |


The Thing backdoor for Windows allows remote system access

Risk Level: High risk vulnerability High

Check or Attack Name: BackdoorTheThing
Platforms: Trojan Horse: Windows
Description:

The Thing is a backdoor for Windows 9x/NT that allows an attacker to access your computer remotely. The attacker can upload, execute, copy, move, and delete files, as well as reboot your computer. This trojan also has the added feature to send an ICQ message to a preconfigured user every time your system starts up announcing your IP to the attacker.
Remedy:

To remove The Thing, you must first find the filename that it is using. First, using Regedit, find the key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run". Find the value named "(default)". Normally, this entry will have no data, but if The Thing is on your machine, the data will be the path to a file. This file is one of the files The Thing creates. Delete the "(default)" registry entry, and remember the filename that was stored. You will need to reboot your computer into MS-DOS mode if you are using Windows95/98 to delete the file. In NT you can use the Task Manager to kill the process of the file, then delete it from your drive. The Thing also modifies your System.ini file to start it at boot time, it will change the line reading "shell=explorer.exe" to "shell=explorer.exe ms097.exe". The filename that it uses is configurable, so it may not be "ms097.exe". Different versions of The Thing use different filenames by default. You will need to delete the second file listed on that line from your Windows system directory after rebooting to MS-DOS mode in Windows9x, or after killing the process in NT's Task Manager. After following these steps your computer will be free from the The Thing backdoor.
References:


Oracle database server detection

Risk Level: | Low risk vulnerability Low | Check or Attack Name: OracleDetect
Platforms: | Oracle
Description: | Oracle Database Servers typically provide access to valuable corporate data. The mere existence of Oracle servers in your environment warrants closer investigation of how they're configured and secured.
Remedy: | Ensure your Oracle server is properly configured as per your organization's security policy.
References: |


CMail Server contains multiple remotely exploitable overflows in its POP and SMTP commands

Risk Level: High risk vulnerability High

Check or Attack Name: CMailCommandBO
Platforms: CMail Server
Description:

The POP and SMTP commands implemented in the CMail server for Windows 9x and Windows NT contain multiple buffer overflows. The overflows have been shown to be remotely exploitable, and could relinquish complete control of your mail server to an attacker.
Remedy:

Computalynx has released Service Pack 1 for CMail Server 2.3, which corrects this and other security related problems. Users are encouraged to upgrade to the latest version and patch level available.
References:

eEye Digital Security Team Alert AD05261999, Multiple Web Interface Security Holes, http://www.eeye.com/database/advisories/ad05261999/ad05261999.html

Computalynx Ltd., CMail Server, http://mainsite.computalynx.net/cmail.htm

BUGTRAQ Mailing List, C-Mail SMTP Server Remote Buffer Overflow Exploit, http://www.netspace.org/cgi-bin/wa?A2=ind9906c&L=bugtraq&F=&S=&P=1889


CMail server for Windows can be used to read files off vulnerable systems

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: CmailFileread
Platforms: | CMail Server
Description: | A vulnerability in the web administration interface for the CMail multi-protocol mail server for Windows could allow a remote attacker to read certain files off vulnerable hosts via the web interface.
Remedy: | Computalynx has released Service Pack 1 for CMail Server 2.3 which corrects this and other security related problems. Users are encouraged to upgrade to the latest version and patch level available.
References: | eEye Digital Security Team Alert AD05261999, Multiple Web Interface Security Holes, http://www.eeye.com/database/advisories/ad05261999/ad05261999.html Computalynx Ltd., CMail Server, http://mainsite.computalynx.net/cmail.htm


FTGate web interface allows remote attackers to read files from the system

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: FTGateRead
Platforms: | FTGate
Description: | A vulnerability in the web interface to the FTGate mail server for Windows could allow a remote attacker to retrieve files from the system.
Remedy: | Contact Floosietek for remedy or upgrade information. Until you can obtain a fixed version from Floosietek, disable the web interface.
References: | Floosietek Ltd, FTGate Mail Server Homepage, http://www.floosietek.com/ eEye Digital Security Team Alert AD05261999, Multiple Web Interface Security Holes, http://www.eeye.com/database/advisories/ad05261999/ad05261999.html


NTMail could allow remote attackers to read arbitrary files off the system

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: NTMailFileRead
Platforms: | NTMail
Description: | NTMail is a commercial mail server for Windows NT systems. A vulnerability in the web interface to NTMail could allow a remote attacker to read any file off the vulnerable system's file system.
Remedy: | Gordano has fixed this problem in the 4.3 release of NTMail. Users are encouraged to install the latest version available at all times.
References: | eEye Digital Security Team Alert AD05261999, Multiple Web Interface Security Holes, http://www.eeye.com/database/advisories/ad05261999/ad05261999.html Gordano Ltd, NTMail, http://www.ntmail.co.uk/


Qpopper contains an overflow in the PASS command which could compromise root privileges

Risk Level: High risk vulnerability High

Check or Attack Name: QpopperPASSOverflow
Platforms: SCO OpenServer, qpopper, SCO Internet FastStart
Description:

A buffer overflow vulnerability exists in the qpopper server produced by Qualcomm. A remote attacker can issue a PASS command of excessive length to the server and cause an internal buffer to be overflowed. This could allow an attacker to execute arbitrary code on the server with root privileges.
Remedy:

This vulnerability affects qpopper 2.41 and below and was fixed in version 2.5. It is recommended users upgrade to the latest stable release available.
References:

BUGTRAQ Mailing List, More problems with QPOPPER - <sigh>, http://www.netspace.org/cgi-bin/wa?A2=ind9806E&L=bugtraq&P=R252

CERT Advisory CA-98.08, Buffer overflows in some POP servers, http://www.cert.org/advisories/CA-98.08.qpopper_vul.html

Silicon Graphics Inc. Security Advisory 19980801-01-I, BSD/Qualcomm qpopper Vulnerability, ftp://sgigate.sgi.com/security/19980801-01-I


CGI Perl mail program allow execution of arbitrary commands

Risk Level: | High risk vulnerability High | Check or Attack Name: CgiPerlMailPrograms
Platforms: | Common Gateway Interface (CGI)
Description: | Many Perl-based mail programs that come from sites, such as www.cgi-resources.com, contain vulnerabilities. Many of these programs accept metacharacters in the recipient's e-mail address field. A malicious user can put specially crafted metacharacters into these fields and execute arbitrary commands on the system running these Perl scripts.
Remedy: | Either fork your sendmail process and strip metacharacters (or only allow certain characters), or use the open (MAIL , "|$sendmail -t") or rm -rf./cgi-bin commands.
References: | BUGTRAQ Mailing List, Several new CGI vulnerabilities, http://geek-girl.com/bugtraq/1998_4/0373.html


IIS ExAir sample site denial of service attack

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: IIS ExAir DoS
Platforms: | IIS: 4.0
Description: | A denial of service attack exists against the IIS sample site pages called ExAir. If select ExAir active server pages are called directly without being called from the main page, then the pages do not load the DLLs correctly. This action results in IIS hanging and causing the CPU usage to jump to 100%.
Remedy: | Remove the IIS ExAir Sample Site (see the Windows NT Option Pack 4 Setup for details).
References: | BUGTRAQ Mailing List, IIS 4 Advisory - ExAir sample site DoS, http://www.netspace.org/cgi-bin/wa?A2=ind9901D&L=bugtraq&P=R5573


Netscape Enterprise and FastTrack servers contain a remotely exploitable buffer overflow

Risk Level: High risk vulnerability High

Check or Attack Name: NetscapeGetBo
Platforms: Netscape FastTrack, Netscape Enterprise Server
Description:

Internet Security Systems (ISS) X-Force has discovered a vulnerability in the Netscape Enterprise Server and Netscape FastTrack Server. Netscape produces web servers and web browsers for individuals, small workgroups, and business professionals. An attacker can send the web server an overly long HTTP GET request, overflowing a buffer in the Netscape httpd service and overwriting the process's stack. This allows a sophisticated attacker to force the machine to execute any program code that they send. The ISS X-Force has demonstrated that it is possible to use this vulnerability to execute arbitrary code as SYSTEM on the server, giving an attacker full control of the machine.
Remedy:

Netscape has released a patch which corrects this problem. Administrators should obtain and apply this patch as soon as possible.
References:

ISS Security Advisory #37, Buffer Overflow in Netscape Enterprise and FastTrack Web Servers, http://xforce.iss.net/alerts/advise37.php3

CIAC Information Bulletin J-062, J-062: Netscape Enterprise and FastTrack Web Servers Buffer Overflow, http://www.ciac.org/ciac/bulletins/j-062.shtml


IIS unauthorized ODBC data access with RDS

Risk Level: High risk vulnerability High

Check or Attack Name: IIS RDS
Platforms: IIS: 4.0, Microsoft Data Access Components (MDAC)
Description:

Implicit remoting is enabled via the Microsoft Internet Information Server (IIS) web server. RDS allows an unauthorized user access to ODBC databases via IIS.

Remote Data Services (RDS) is installed by default when Windows NT Server's Internet Information Service (IIS) 4.0 is installed through the Microsoft Windows NT Option Pack. The goal of the RDS component is to enable controlled Internet access to remote data resources through the Windows NT's IIS. However, because the RDS DataFactory (a single component of RDS) allows implicit remoting of data access requests by default, it can be exploited to allow unauthorized Internet clients to access OLE database (DB) datasources available to the server. The implicit remoting function of the RDS 1.5 through the DataFactory component should be disabled.

A web client could issue a SQL command along with the name or Internet Protocol (IP) address of a remote SQL Server system, a SQL account and password, a database name, and a SQL query string. If the request is valid (the remote server is reachable by the Windows NT IIS server, the user account and password are correct, and the database name is valid), the query results will be sent through HTTP back to the client. Although it is true that this operation requires significant inside information, the potential accessibility of this information should not be underestimated; organizations that don't practice good computing practices could have blank or easy-to-guess passwords on their SQL administrator accounts. The RDS DataFactory object along with other installed ODBC drivers opens other possibilities, including possible access to non-published files on the Windows NT IIS server.

The risk of security vulnerability caused by the DataFactory is even greater if newer OLE DB Providers are installed on the server. "Microsoft DataShape Provider" and "Microsoft JET OLE DB provider" (which ship with MDAC 2.0 in Visual Studio 98) allow shell commands to be executed. If the DataFactory is enabled on such a server, Internet clients can use these providers to execute shell commands, which can potentially bring down the server or otherwise severely affect its performance.
Remedy:

Delete the following registry keys from the Registry Editor or a batch file:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.DataFactory
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDataFactory
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.VbBusObjCls

Using the Registry Editor, delete the registry keys as follows:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run. Type regedt32 and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch registry key.
  3. Select the RDSServer.DataFactory key.
  4. From the Edit menu, select Delete and verify the deletion.
  5. Repeat steps 3 and 4 to delete the AdvancedDataFactory and VbBusObj.VbBusObjCls keys.

—OR—

Use the REGDEL.exe command-line utility to remove DataFactory functionality. REGDEL.exe is a tool available as part of the Windows NT Resource Kit utilities that can be used to delete registry entries from the command line:

  1. Copy the following text into a .bat file (for example, c:\dfremove.bat) and run the batch file on machines on which you want to remove the RDS components.

    2. REM Batch file to remove RDS components
    REM Make sure that REGDEL.exe from the Resource Kit is in your PATH
    REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDataFactory"
    REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.DataFactory"
    REGDEL "SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.VbBusObjCls"
    Echo RDS Keys Removed

  2. Execute or run the batch file on the web server.
References:

Microsoft Security Bulletin MS98-004, Unauthorized ODBC Data Access with RDS and IIS, http://www.microsoft.com/security/bulletins/ms98-004.asp

Microsoft Knowledge Base Article Q184375, Security Implications of RDS 1.5, IIS 3.0 or 4.0, and ODBC, http://support.microsoft.com/support/kb/articles/q184/3/75.asp

Microsoft Security Bulletin MS99-025, Re-Release: Unauthorized Access to IIS Servers through ODBC Data Access with RDS, http://www.microsoft.com/security/bulletins/ms99-025.asp

CIAC Information Bulletin J-054, J-054: Unauthorized Access to IIS Servers through ODBC Data Access with RDS, http://www.ciac.org/ciac/bulletins/j-054.shtml


UnityMail administrative web server denial of service

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: UnityMail web server dos
Platforms: UnityMail
Description:

UnityMail is a popular commercial mailing list server for Windows NT produced by Revnet Systems. A denial of service vulnerability exists in the web administration interface of UnityMail 2.0 (and perhaps previous versions). A remote attacker could flood the HTTP server with unusually long headers causing the server to consume all available processor resource and deny access to the web interface.
Remedy:

Contact your Revnet Systems support representative for patch information.
References:

BUGTRAQ Mailing List, Re: Web servers / possible DOS Attack / mime header flooding, http://www.netspace.org/cgi-bin/wa?A2=ind9809A&L=bugtraq&P=R2611

Revnet Systems' UnityMail Home Page, UnityMail -- the database-driven email list server for Windows NT UnityMail -- the database-driven email list server for Windows NT, http://www.unitymail.com/


Internet Scanner Vulnerabilities by Category

Overview

This help file contains descriptions of 34 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Category
Category: Vulnerabilities:
Backdoors
BackdoorAolAdmin | AOL Admin backdoor for Windows allows remote attackers to control AOL actions
BackdoorBackdoor2 | Backdoor2 for Windows allows remote access to infected machines
BackdoorBlazer5 | Blazer5 backdoor for Windows 9x/NT allows remote system access
BackdoorBo2k | Back Orifice 2000 allows complete remote administrative control of compromised machines
BackdoorComa | Coma backdoor allows complete administrative control of infected machines from remote
BackdoorDeltasource | Deltasource backdoor for Windows allows remote access to system files
BackdoorDoly15 | Doly backdoor for Windows allows remote access to files and keystrokes
BackdoorForcedentry | Forced Entry backdoor allows remote registry access and interactive login sessions
BackdoorFrenzy | Frenzy backdoor for Windows 9x allows remote attackers to control the behavior of infected systems
BackdoorHackersparadise | HackersParadise backdoor allows remote access to Windows 9x/NT
BackdoorHvlrat | Hvlrat backdoor for Windows allows a remote attacker to take control of the system's AOL sessions
BackdoorMillenium | Millenium backdoor allows remote attackers to log keystrokes and execute programs
BackdoorNetmonitor | NetMonitor backdoor for Windows 9x/NT allows remote access to system registry and files
BackdoorPhasezero | Phase Zero backdoor for Windows 9x/NT allows complete control of a system and the ability to automatically trash the server
BackdoorProgenic | Progenic backdoor for Windows 9x/NT allows remote access and can interact with ICQ
BackdoorProsiak | Prosiak backdoor allows remote access to files and the ability to setup anonymous proxies
BackdoorSchwindler | Schwindler backdoors for Windows 9x allows remote access to files and user's keystrokes
BackdoorTheThing | The Thing backdoor for Windows allows remote system access
EvilFTP Backdoor | EvilFTP is a backdoor FTP server
GateCrasher Backdoor | GateCrasher is a standard backdoor that includes chatting and rebooting on the infected machine
GirlFriend Backdoor | GirlFriend backdoor has ability to retrieve passwords
Hack'a'tack Backdoor | Hack'a'Tack backdoor allows attackers to manipulate windows on your desktop
NetSphere Backdoor | NetSphere backdoor operates with ICQ
Daemons
OracleDetect Oracle database server detection
E-mail
CMailCommandBO | CMail Server contains multiple remotely exploitable overflows in its POP and SMTP commands
CmailFileread | CMail server for Windows can be used to read files off vulnerable systems
FTGateRead | FTGate web interface allows remote attackers to read files from the system
NTMailFileRead | NTMail could allow remote attackers to read arbitrary files off the system
QpopperPASSOverflow | Qpopper contains an overflow in the PASS command which could compromise root privileges
Backdoors
CgiPerlMailPrograms | CGI Perl mail program allow execution of arbitrary commands
IIS ExAir DoS | IIS ExAir sample site denial of service attack
IIS RDS | IIS unauthorized ODBC data access with RDS
NetscapeGetBo | Netscape Enterprise and FastTrack servers contain a remotely exploitable buffer overflow
UnityMail web server dos | UnityMail administrative web server denial of service


Internet Scanner Vulnerabilities by Risk Level

Overview

This help file contains descriptions of 34 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Risk Level
Category: Vulnerabilities:
High
BackdoorAolAdmin | AOL Admin backdoor for Windows allows remote attackers to control AOL actions
BackdoorBackdoor2 | Backdoor2 for Windows allows remote access to infected machines
BackdoorBlazer5 | Blazer5 backdoor for Windows 9x/NT allows remote system access
BackdoorBo2k | Back Orifice 2000 allows complete remote administrative control of compromised machines
BackdoorComa | Coma backdoor allows complete administrative control of infected machines from remote
BackdoorDeltasource | Deltasource backdoor for Windows allows remote access to system files
BackdoorDoly15 | Doly backdoor for Windows allows remote access to files and keystrokes
BackdoorForcedentry | Forced Entry backdoor allows remote registry access and interactive login sessions
BackdoorFrenzy | Frenzy backdoor for Windows 9x allows remote attackers to control the behavior of infected systems
BackdoorHackersparadise | HackersParadise backdoor allows remote access to Windows 9x/NT
BackdoorHvlrat | Hvlrat backdoor for Windows allows a remote attacker to take control of the system's AOL sessions
BackdoorMillenium | Millenium backdoor allows remote attackers to log keystrokes and execute programs
BackdoorNetmonitor | NetMonitor backdoor for Windows 9x/NT allows remote access to system registry and files
BackdoorPhasezero | Phase Zero backdoor for Windows 9x/NT allows complete control of a system and the ability to automatically trash the server
BackdoorProgenic | Progenic backdoor for Windows 9x/NT allows remote access and can interact with ICQ
BackdoorProsiak | Prosiak backdoor allows remote access to files and the ability to setup anonymous proxies
BackdoorSchwindler | Schwindler backdoors for Windows 9x allows remote access to files and user's keystrokes
BackdoorTheThing | The Thing backdoor for Windows allows remote system access
CMailCommandBO | CMail Server contains multiple remotely exploitable overflows in its POP and SMTP commands
CgiPerlMailPrograms | CGI Perl mail program allow execution of arbitrary commands
EvilFTP Backdoor | EvilFTP is a backdoor FTP server
GateCrasher Backdoor | GateCrasher is a standard backdoor that includes chatting and rebooting on the infected machine
GirlFriend Backdoor | GirlFriend backdoor has ability to retrieve passwords
Hack'a'tack Backdoor | Hack'a'Tack backdoor allows attackers to manipulate windows on your desktop
IIS RDS | IIS unauthorized ODBC data access with RDS
NetSphere Backdoor | NetSphere backdoor operates with ICQ
NetscapeGetBo | Netscape Enterprise and FastTrack servers contain a remotely exploitable buffer overflow
QpopperPASSOverflow | Qpopper contains an overflow in the PASS command which could compromise root privileges
Low
OracleDetect Oracle database server detection
High
CmailFileread | CMail server for Windows can be used to read files off vulnerable systems
FTGateRead | FTGate web interface allows remote attackers to read files from the system
IIS ExAir DoS | IIS ExAir sample site denial of service attack
NTMailFileRead | NTMail could allow remote attackers to read arbitrary files off the system
UnityMail web server dos | UnityMail administrative web server denial of service