OT: Exchange (Was Re: OpenVMS - When downtime is not an option)

On Wed, 04 Jul 2007 05:30:16 -0700, <david20@xxxxxxxxxxxxxxxx> wrote:

In article <h8SdnWZlQ7mWVRfbnZ2dnUVZ_vmqnZ2d@xxxxxxxxxxxxxxxxxxxxxxxx>, Bill Todd <billtodd@xxxxxxxxxxxxx> writes:
Main, Kerry wrote:

....

If the design and/or architecture of the OS platform allows an
application bug to provide access to protected data and/or provides
elevated rights on the system, does sit matter if it is an application
or kernel OS issue?

Clearly, that would be an OS bug (or at least a serious design flaw, if
indeed it were intentional rather than inadvertent) - *if* it had been
the case in this instance.

It was not: the bugs *only* affected Exchange Server. If Exchange
Server was designed such that it had to execute in a privileged
environment (such that once compromised itself it could compromise other
parts of the system as you describe above), rather than designed
modularly such that at most a few critical parts of it might require
privilege (certainly not including the parsing functions that these bugs
affected) and the rest could run unprivileged, that was an *Exchange
Server* design flaw, not a Windows flaw.


What is this "IF" ?

From http://www.microsoft.com/technet/security/bulletin/ms07-026.mspx


"An attacker who successfully exploited this vulnerability could take
complete control of the affected system. An attacker could then install
programs; view, change or delete data; or create new accounts with full user
rights"

Obviously this means that the codepath executed by the bug must run at a high
privilege level. Whether that is because Exchange is running with higher
privileges than it really needs because of bad design and implementation or
whether it is doing something which requires it to have high privileges at that
point in time is not something easily judged without access to the design
documents and/or source of Exchange.

If as you seem to believe it is bad design and implementation in Exchange
causing it to run at higher privileges than needed then it is down to those
designing and programming Exchange at Microsoft. However Exchange is a
Microsoft product and those same designers and programmers have probably also
worked on the OS code during their careers and have had their code reviewed
by the same quality control people.

Also similar bugs affect lots of Microsoft products which also result in
an attacker gaining complete control of the system. Hence similar comments
apply to all those involved with the design and programming of those products.

Hence either we have all these Microsoft designers and programmers making
similar mistakes (ie unnecessarily running their code with elevated privileges
when parsing input data) for all these Microsoft Apllications but not making
any mistakes in the OS or we have major problems in the OS which the
application programmers have trouble avoiding when writing their code.


As an aside, which I find disturbing, 3 of the 4 banks where I keep accounts use
Exchange for the front-ends, and this is for online banking! Fortunately they
are local so I can drive to them.


David Webb
Security team leader
CCSS
Middlesex University


- bill



--
PL/I for OpenVMS
www.kednos.com
.

Relevant Pages

  • Re: OpenVMS - When downtime is not an option
    ... application bug to provide access to protected data and/or provides ... the bugs *only* affected Exchange Server. ... Server* design flaw, not a Windows flaw. ... whether it is doing something which requires it to have high privileges at that ...
    (comp.os.vms)
  • Re: OT: Exchange (Was Re: OpenVMS - When downtime is not an option)
    ... application bug to provide access to protected data and/or provides ... the bugs *only* affected Exchange Server. ... Server* design flaw, not a Windows flaw. ... Microsoft product and those same designers and programmers have probably ...
    (comp.os.vms)
  • Re: Exchange 2003 Design Considerations
    ... >and are in the design process deciding how to configure the domains and exchange 2003. ... Problem comes when trying to figure out if installing exchange 2003 on the foo.org domain will allow us to setup ... >or student domain we want the exchage server to create a mailbox for them. ... servers Different storage groups for the Staff ...
    (microsoft.public.exchange.setup)
  • Re: more best practice questions
    ... but I have limited Exchange experience. ... guess my question is do I wait for E12 and design around that or should I ... have four active servers. ...
    (microsoft.public.exchange.admin)
  • Re: AD Design Gurus
    ... just Exchange, but other applications and services through citrix farms, ... > some good deployment design for your Active Directory. ... > Single forest all domains share a global Schema. ...
    (microsoft.public.windows.server.active_directory)
Loading