Secure Sockets Layer PCT1 buffer overflow
| ssl-pct1-bo (12380) |  High Risk |
Description:
Multiple vendor applications are vulnerable to a buffer overflow in the Private Communications Transport (PCT) protocol of the Secure Sockets Layer (SSL) library. PCT is a legacy protocol and is no longer commonly used. If SSL is enabled, a remote attacker could send a specially-crafted TCP message to the vulnerable system, to overflow a buffer and execute arbitrary code on the system.
Note: Microsoft Windows Server 2003 and Internet Information Services are only affected by this issue if PCT is also enabled.
*CVSS:
| Base Score: | 7 |
| Access Vector: | Remote |
| Access Complexity: | Low |
| Authentication: | Not Required |
| Confidentiality Impact: | Partial |
| Integrity Impact: | Partial |
| Availability Impact: | Partial |
| Temporal Score: | 6.7 |
| Exploitability: | Functional |
| Remediation Level: | Unavailable |
| Report Confidence: | Confirmed |
Consequences:
Gain Access
Remedy:
For vulnerability detection:
Enable the following checks in the ISS Protection Platform:
WinMs04011Patch
SSLPCTEnabled
ssl-pct-enable
Enable the following checks in the ISS Protection Platform:
SSL_PCT1_Overflow
For Manual Protection:
Apply the appropriate patch for your system, as listed in the Microsoft Security Bulletin MS04-011. See References.
References:
- CIAC Information Bulletin O-114: Microsoft Security Update for Microsoft Windows.
- CIAC Information Bulletin O-114: Microsoft Security Update for Microsoft Windows [REVISED 25 Jun 2004].
- Internet Security Systems Security Advisory, April 13, 2004: Microsoft SSL Library Remote Compromise Vulnerability.
- Internet Security Systems Security Alert, April 13, 2004: Multiple Vulnerabilities in Microsoft Products.
- Microsoft Security Bulletin MS04-011: Security Update for Microsoft Windows (835732).
- SecuriTeam Mailing List, Windows focus 22 Apr 2004: Microsoft SSL Library Remote Compromise Vulnerability (MS04-011, Exploit).
- BID-10116: Microsoft Windows Private Communications Transport Protocol Buffer Overrun Vulnerability
- CVE-2003-0719: Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.
- US-CERT VU#586540: Microsoft Private Communication Technology (PCT) fails to properly validate message inputs
Platforms Affected:
- Microsoft Exchange Server 2000
- Microsoft Exchange Server 2003
- Microsoft Exchange Server 5.5
- Microsoft IIS 6.0
- Microsoft Internet Information Server 5.0
- Microsoft Internet Information Services 4.0
- Microsoft Internet Information Services 5.1
- Microsoft NetMeeting
- Microsoft Windows 2000 SP2
- Microsoft Windows 2000 SP4
- Microsoft Windows 2000 SP3
- Microsoft Windows 2003 Server
- Microsoft Windows 2003 Server x64
- Microsoft Windows NT 4.0 SP6a Workstation
- Microsoft Windows NT 4.0 SP6a Server
- Microsoft Windows NT 4.0 SP6 Terminal Server
- Microsoft Windows XP 2003 x64
- Microsoft Windows XP SP1
Reported:
Apr 13, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.