Broadband Tech > Security > Security > Mircosoft WebDAV patch out!!!

Mircosoft WebDAV patch out!!!

here we go again. Out for everyone except us XP SP2 users. I am still not putting SP3 on here.

reply to Mele20
I can't get the xp sp3 download to work

reply to Anon users
I took a look at the Win2003 download, and it looks like it's a brand new "ntdll.dll" that's contains the new functionality.

reply to Mele20

reply to Anon users
Got the files for XP-sp3 (32 bit)

Showing two files:
NTDLL.DLL
mrxdav.sys

reply to Cabal
Yes, but my default Opera 10.61 may feel too advanced so it feels left out also! Can't win.

reply to Anon users
Thx Anon Users (and Frodo in the other thread) for posting.

The patch seems fuzzy and conditional depending on the scenario though. For those lacking access to the patch, from this thread,

»Code-Execution Bug in Windows and HUNDREDS of Apps

block outbound activity on ports 139 and 445 (with your firewall) and disable WebDAV client service. I would extend that to include ports 135, 137, and 138. If any apps break, create exception rules as necessary.
And disable shares unless needed (per the Snowman's remarks in the aforementioned thread). As of current disclosure of the vulnerability, this should prevent the exploit.
Funny how 10 years ago, these were the first ports to get block rules in BlackIce.
Hope this helps those worried about not having access to the patch.

reply to Frodo

reply to Anon users
This does not solve the problem and is not a true patch. It is only a registry update.

If you read the OP's links here's what is really said:

said by Microsoft :

---

Today we released Security Advisory 2269637 notifying customers of a remote attack vector to a class of vulnerabilities affecting applications that load DLL’s in an insecure manner. The root cause of this issue has been understood by developers for some time. However, last week researchers published a remote attack vector for these issues, whereas in the past, these issues were generally considered to be local and relatively low impact.

For the sake of this issue, its sufficient to say that if an attacker can cause an application to LoadLibrary() while the application’s current directory is set to an attacker-controlled directory, the application will run the attacker's code.

The most likely exploit scenario involves an attacker convincing the victim to open a file hosted on an attacker-controlled SMB or WebDAV share. The file itself would not necessarily be malicious or malformed. The key is that the file is loaded from a location where an attacker can also place a malicious DLL with the same name as a DLL the vulnerable application loads.

This update introduces a new registry key CWDIllegalInDllSearch that allows users to control the DLL search path algorithm. The DLL search path algorithm is used by the LoadLibrary API and the LoadLibraryEx API when DLLs are loaded without specifying a fully qualified path.

The newly introduced CWDIllegalInDllSearch registry key enables computer administrators to modify the behavior of the DLL search path algorithm that is used by LoadLibrary and by LoadLibraryEx. This registry key could allow certain kinds of directories to be skipped.

Loading dynamic libraries is basic behavior for Windows and other operating systems, and the design of some applications require the ability to load libraries from the current working directory. Hence, this issue cannot directly be addressed in Windows without breaking expected functionality. Instead, it requires developers to ensure they code secure library loads. However, we’re looking into ways to make it easier for developers to not make this mistake in the future.

---

Will this be available via 'Microsoft Update'?

reply to SUMware