__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Windows Vista Vulnerability [US-CERT Vulnerability Note VU#889747] March 27, 2008 13:00 GMT Number S-229 ______________________________________________________________________________ PROBLEM: Windows Vista fails to properly handle the NoDriveTypeAutoRun registry value, which may prevent Vista from effectively disabling AutoRun and AutoPlay features. PLATFORM: Windows Vista DAMAGE: May allow an attacker to cause a user to inadvertently execute arbitrary code on a removable device, such as a USB drive. SOLUTION: There is currently no practical solution. Please see the bulletin below for a possible workaround. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. Windows VIsta may have some AutoPlay ASSESSMENT: enabled, even though the Group Policy Editor and associated registry values indicate otherwise. This may allow an attacker to cause a user to inadvertently execute arbitrary code on a removable device, such as a USB drive. ______________________________________________________________________________ CVSS 2 BASE SCORE: 9.4 TEMPORAL SCORE: 8.0 VECTOR: (AV:N/AC:L/Au:N/C:C/I:C/A:N/E:POC/RL:W/RC:C) ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/s-229.shtml ORIGINAL BULLETIN: http://www.kb.cert.org/vuls/id/889747 CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2008-0951 ______________________________________________________________________________ [***** Start US-CERT Vulnerability Note VU#889747 *****] Vulnerability Note VU#889747 Windows Vista fails to properly handle the NoDriveTypeAutoRun registry value Overview Windows Vista fails to properly handle the NoDriveTypeAutoRun registry value, which may prevent Vista from effectively disabling AutoRun and AutoPlay features. I. Description AutoRun, which was introduced with Windows 95, is a feature that causes Windows to automatically take an action when a removable media device is inserted. For example, when an AutoRun-enabled CD-ROM is inserted, Windows may automatically execute a program on that disc. This also holds true for U3-enabled USB devices, which emulate a CD-ROM device as well as provide USB mass storage capabilities. These devices can automatically execute code when they are inserted into a Windows system. The AutoRun action can also take place when the user clicks the icon for an AutoRun-enabled device. AutoRun is enabled by default in Windows. AutoPlay, which was introduced with Windows XP, extends AutoRun capabilities to also allow a menu to be presented to the user, which lists actions that the user may take. AutoRun and AutoPlay can be disabled by setting the CDRom Autorun registry value to 0 and also setting the NoDriveTypeAutoRun registry value to 0xFF. The NoDriveTypeAutoRun registry value is directly tied to the Group Policy setting for "Turn off Autoplay." Windows Vista fails to properly handle the NoDriveTypeAutoRun registry value. According to Microsoft's documentation, setting NoDriveTypeAutoRun to 0xFF should disable AutoPlay for all types of drives. However, when this registry value is present, Vista enables some AutoPlay features that may not have been enabled prior to setting that registry value. For example, if NoDriveTypeAutoRun is set to 0xFF, Vista may execute a program specified in the Autorun.inf file when the device icon is clicked. Other values for NoDriveTypeAutoRun may also enable certain AutoPlay features in Vista. II. Impact Windows Vista may have some AutoPlay enabled, even though the Group Policy Editor and associated registry values indicate otherwise. This may allow an attacker to cause a user to inadvertently execute arbitrary code on a removable device, such as a USB drive. III. Solution We are currently unaware of a practical solution to this problem. Please consider the following workarounds: Disable AutoRun and AutoPlay in Vista With limited testing, it appears to be possible to disable AutoRun and AutoPlay on Windows Vista systems by taking the following steps: Set the Autorun registry value for CDs to 0. This will prevent Windows from sending a Media Change Notification (MCN) message when a CD-ROM is inserted, which will in turn prevent AutoPlay with these devices. Disable AutoPlay for all media and devices, by clearing the Use AutoPlay for all media and devices setting in the Windows Control Panel. Details for how to do this are available in the Windows Help and How-to. Do not set the NoDriveTypeAutoRun registry values in HKLM or HKCU. If they are present, we recommend removing the values. This can be also be accomplished by using the Group Policy Editor to set the "Turn off Autoplay" option to "Not Configured" Set the "Default behavior for Autorun" to Enabled - "Do not execute any autorun commands" in the Group Policy Editor. The relevant settings in the Group Policy editor can be reached by running gpedit.msc and going to Local Computer Policy -> Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies. Systems Affected Vendor Status Date Updated Microsoft Corporation Vulnerable 28-Feb-2008 References http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/ 91525.mspx http://support.microsoft.com/kb/155217 http://windowshelp.microsoft.com/Windows/en-US/Help/40f23376-1351-49d5-8d48- 5c05d35f2ac81033.mspx http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/ 30300.mspx http://technet.microsoft.com/en-us/magazine/cc137730.aspx Credit This vulnerability was reported by Will Dormann of the CERT/CC. Some details were provided by Jeff Gennari of the CERT/CC. This document was written by Will Dormann. Other Information Date Public 03/20/2008 Date First Published 03/20/2008 11:32:02 AM Date Last Updated 03/24/2008 CERT Advisory CVE Name CVE-2008-0951 US-CERT Technical Alerts Metric 0.19 Document Revision 19 [***** End US-CERT Vulnerability Note VU#889747 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of US-CERT for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) S-213: Nukedit 'email' Parameter Vulnerability S-214: SurgeMail and WebMail 'Page' Command Vulnerability S-215: Symantec Backup Exec Scheduler ActiveX Control Multiple Vulnerabilities S-216: Juniper Networks Secure Access 2000 'rdremediate.cgi' Vulnerability S-217: Drupal Multiple HTML Vulnerabilities S-218: gd Security Update S-219: Juniper Networks Secure Access 2000 Web Root Path Vulnerability S-220: PHP-Nuke My_eGallery Module 'gid' Parameter Vulnerability S-221: Learn2 STRunner ActiveX Control Vulnerabilities S-222: Evolution Security Update