[Dshield] *Fixed* Webdav exploit

Rick Leske rick at jaray.net
Tue Mar 25 05:01:11 GMT 2003


Umm.. please pardon my ignorance but didn't microsoft already release a
patch for this or are there further issues with the ntdll.dll?

tia,

~Rick

----- Original Message -----
From: "Hines, Eric" <ehin4 at allstate.com>
To: <list at dshield.org>
Sent: Monday, March 24, 2003 5:28 PM
Subject: [Dshield] *Fixed* Webdav exploit


> List:
>
> A colleague here at work, Jove <jove at halo.nu>, has fixed the exploit
posted
> by Rafael Nunez to the Bugtraq/Vulndev list. I have attached it herein.
> Remember that IIS is not the culprit application. Many apps use ntdll.dll.
>
> Note: we have been seeing an increased amount of dropped packets by our
> firewall clusters since this afternoon. Be on the lookout for active
Webdav
> exploit attempts.
>
> Eric Hines
> Internet Warfare and Intelligence
> Fate Research Labs
> http://www.fatelabs.com
>
>
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>
>   Flags:        0x00
>   Status:       0x00
>   Packet Length:1518
>   Timestamp:    14:23:37.337396 03/24/2003
>
> Ethernet Header
>   Destination:          00:09:6B:61:70:5D
>   Source:               00:D0:59:D8:6B:C5
>   Protocol Type:        0x0800  IP
>
> IP Header - Internet Protocol Datagram
>   Version:              4
>   Header Length:        5  (20  bytes)
>   Type of Service:      %00000000
>                         000. .... Precedence: Routine,
>                         ...0 .... Normal Delay,
>                         .... 0... Normal Throughput,
>                         .... .0.. Normal Reliability
>                         .... ..0. ECT bit - transport protocol will ignore
> the CE bit
>                         .... ...0 CE bit - no congestion
>   Total Length:         1500
>   Identifier:           1117
>   Fragmentation Flags:  %010
>                         0.. Reserved
>                         .1. Do Not Fragment
>                         ..0 Last Fragment
>   Fragment Offset:      0  (0  bytes)
>   Time To Live:         128
>   Protocol:             6  TCP - Transmission Control Protocol
>   Header Checksum:      0xC94E
>   Source IP Address:    10.46.137.219  ALLSTATE-ERNGD3
>   Dest. IP Address:     10.46.137.57  MAST_HODC
>   No IP Options
>
>
> TCP - Transport Control Protocol
>   Source Port:          1085  webobjects
>   Destination Port:     80  http
>   Sequence Number:      600740565
>   Ack Number:           577469618
>   Offset:               5  (20  bytes)
>   Reserved:             %000000
>   Flags:                %010000
>                         0. .... (No Urgent pointer)
>                         .1 .... Ack
>                         .. 0... (No Push)
>                         .. .0.. (No Reset)
>                         .. ..0. (No SYN)
>                         .. ...0 (No FIN)
>   Window:               64240
>   Checksum:             0xA7D4
>   Urgent Pointer:       0
>   No TCP Options
>
>
> HTTP - Hyper Text Transfer Protocol
>   Line  1:              SEARCH
>
/<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE

>
><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
>
<SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><
>
SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><S
>
LE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SL
>
E><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE
> ><SLE><SLE><SLE><SLE><SLE><SLE><SLE><SLE>
> FCS - Frame Check Sequence
>   FCS (Calculated):     0xD2A674EE
>
>


----------------------------------------------------------------------------
----


> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
>

___________________________________________________________________
Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.



More information about the list mailing list