Introduction

This week SANS institute issued a special FLASH message warning about what they describe as

"(...) probably the most dangerous programming error in Windows workstation (all varieties -- 95, 98, 2000, NT 4.0) that Microsoft has made."

When this is written there is no fix available. However, Microsoft has published a workaround for this vulnerability. See below.

Vulnerable systems are those which have installed

• Microsoft Access 97 and 2000 and
• Microsoft Internet Explorer - all version from 4.0 (including the newly released 5.5)

The issue

The vulnerability implies that you are affected by just viewing or reading an email or a web page.

Microsoft Internet Explorer allows an HTML tag in a web page or email to load ActiveX controls. Microsoft Office documents (e.g. Access databases) are examples of ActiveX controls. By default Internet Explorer loads such controls without prompting the user. However, several users have configured Internet Explorer to prompt before opening such controls, as there have been lots of security issues involved with silently executing ActiveX controls. Others have disabled Active Scripting in Internet Explorer, thus disabling executing ActiveX controls.

The vulnerability here on the other hand, is not avoided by either configuring Internet Explorer to prompt before executing ActiveX controls, or disabling Active Scripting altogether. This vulnerability is a result of an error in the sequence which Internet Explorer handles .MDB files (Access databases).

It appears that what happens is in this order:

1. Internet Explorer opens a web page or email with an object tag which attempts to open an .MDB file.
2. The .MDB file is downloaded and Access is called to open the database.
3. Internet Explorer prompts the user to open the database (if IE is set up to prompt) or
4. Internet Explorer informs the user that there is an unsafe ActiveX control on the page (if IE is set up to disable scripting altogether).

The problem here is that event 2 occurs before 3. The database (.MDB file) is already opened before the users has the option to say yes or no.

Given the fact that Access databases support Visual Basic for Applications (.VBA files), a computer which is set up as described in the introduction above, is vulnerable to almost anything.

This exploit can be executed from web pages and emails which supports HTML, e.g. MS Outlook, Outlook express and the popular email client Eudora from Qualcomm.

How to secure the workstations

As mentioned above there is currently no fix from Microsoft available.

However, Microsoft has published a workaround to secure the affected workstations:

1. Start Access 2000 but don't open any databases
2. From the Tools menu, choose Security
3. Select User and Group Accounts
4. Select the Admin user, which should be defined by default
5. Go to the Change Logon Password tab
6. The Admin password should be blank if it has never been changed
7. Assign a password to the Admin user
8. Click OK to exit the menu

More information here:

• SANS Flash advisory: Dangerous Windows Flaw
• Microsoft's Frequently Asked Questions about Security Bulletin MS00-049
• Microsoft's Security Bulletin MS00-049

  Note that all these documents describe two different vulnerabilities. The one described in this Security Information, and considered by far the most dangerous, is what Microsoft (a bit misleading) has called the "IE Script vulnerability" Note also that according to SANS the vulnerability affects versions of IE from 4.0 and above, while Microsoft says that IE from 4.01 SP 2 and above are vulnerable. Similarly SANS says that both Access 97 and 2000 are vulnerable, while Microsoft says that this only affects Access 2000.

Food for thought

Sans is offering a small prize for anyone who can fix this problem automatically. According to their web page:

"It may be possible to fix this vulnerability automatically, via an email without asking every user to take action. The concept is similar to using a slightly modified version of a virus to provide immunity against infection."

This may be interpreted as an encouragement to create a virus to solve the problem automatically . In Norman's view this would not be a good concept to solve the problem. The creation of self-replicating programs (viruses) should not be encouraged even if the intention may be good.

It is much safer, and more in compliance with computer security, to create a program which fixes this security issue only, without any kind of additional viral program code.

Presumably SANS did not intend to encourage to solve the problem by using viral techniques, but a technique which implemented the workaround with minor interference from the users being protected.

Per Olav Førland