What's the scope of the vulnerability?
This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could, under a very daunting set of circumstances, gain the ability to modify business-critical data that could then be replicated to data repositories throughout an enterprise.
The vulnerability would likely be quite difficult to exploit. It would require great technical sophistication on the part of the attacker, as the vulnerability provides only access to low-level data structures. In addition, the attacker would almost certainly need insider knowledge of how various databases and directories throughout the enterprise were configured and used.
What causes the vulnerability?
The vulnerability results because MMS logon credentials are not correctly verified when an LDAP client accesses MMS under certain circumstances.
What is MMS?
Microsoft Metadirectory Services is a metadirectory service - that is, a directory that's used to manage other directories and data sources. In many companies, business-critical data is held in a variety of data sources. For instance, a company might have users' email information stored within the Exchange directory, account information stored within Active Directory, and personnel information stored within a custom database. MMS provides a way to link all of those data sources together, manage them centrally, and ensure that the data in them is always synchronized.
How widely is MMS used?
MMS is not a commonly deployed system. It typically is deployed only within enterprises that have a large number of heterogeneous data sources that require integration and centralized management.
What's wrong with MMS?
The problem lies in the way MMS regulates access to its data repository. All connections to the repository should be checked to ensure that the person making the connection has the proper credentials to perform the actions they're performing. However, it's possible to connect to the repository in an unusual way that has the effect of bypassing the check.
What's the MMS data repository?
MMS needs to store two different types of data locally. First, it needs to store configuration information for MMS itself, such as administrator userids and passwords. Second, depending upon the specific deployment scenario, it may need to store data that isn't found in any of the other directories or databases - that is, MMS may need to act as a directory in its own right, and ensure that the data in that directory is kept consistent with the data in the other directories and databases.
What could this vulnerability enable an attacker to do?
The vulnerability could enable an attacker to modify data in the MMS data repository. A successful attack could allow the attacker to, for instance, reset the MMS administrator password and then subsequently log directly onto MMS as an administrator. It also could enable the attacker to create data that would be replicated to the other data sources.
However, exploiting the vulnerability would be quite difficult. Because the vulnerability provides access to the underlying data structures rather than MMS itself, the attacker would need to possess a great deal of technical knowledge about how MMS works at a protocol level. In addition, the specific layout of the data repository is unique for every deployment, so the attacker would need insider knowledge about the particular MMS deployment.
Who could exploit the vulnerability?
The vulnerability could be exploited by an attacker who could create a connection to the MMS system, and had both a detailed understanding of how to manipulate the MMS data repository at a protocol level and significant information about the specific MMS deployment.
Could the vulnerability be exploited via the Internet?
If normal firewalling precautions had been observed (specifically, if port 389 were blocked), users on the Internet would not be able to create a connection, and thus could not exploit the vulnerability.
What does the patch do?
The patch eliminates the vulnerability by instituting proper credential checking against accesses made to the MMS data repository.
