Microsoft Security Bulletin MS03-016

Technical description:

Microsoft BizTalk Server is an Enterprise Integration product that allows organizations to integrate applications, trading partners, and business processes. BizTalk is used in intranet environments to transfer business documents between different back-end systems as well as extranet environments to exchange structured messages with trading partners. This patch addresses two newly reported vulnerabilities in BizTalk Server.

The first vulnerability affects Microsoft BizTalk Server 2002 only. BizTalk Server 2002 provides the ability to exchange documents using the HTTP format. A buffer overrun exists in the component used to receive HTTP documents - the HTTP receiver - and could result in an attacker being able to execute code of their choice on the BizTalk Server.

The second vulnerability affects both Microsoft BizTalk Server 2000 and BizTalk Server 2002. BizTalk Server provides the ability for administrators to manage documents via a Document Tracking and Administration (DTA) web interface. A SQL injection vulnerability exists in some of the pages used by DTA that could allow an attacker to send a crafted URL query string to a legitimate DTA user. If that user were to then navigate to the URL sent by the attacker, he or she could execute a malicious embedded SQL statement in the query string.

Mitigating factors:

HTTP Receiver Buffer Overflow

• The HTTP Receiver is only present in Microsoft BizTalk Server 2002. BizTalk Server 2000 is not affected by this vulnerability.
• The HTTP receiver is not enabled by default. HTTP must be explicitly enabled as a receive transport during the setup of a BizTalk site.
• If the vulnerability was exploited to run arbitrary code, the code would run in the security context of the IIS Server. If the IIS Server is running under a user account, the attacker's permissions will be limited to those of this user account.

DTA SQL Injection

• DTA users by default are not highly privileged SQL users such as database owners, since they are only required to be members of "BizTalk Server Report Users" security group in order to use DTA web interface. In this case, a successful attacker's permissions on the SQL Server will be restricted.

Severity Rating:

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability identifiers:

• HTTP Receiver Buffer Overflow: CAN-2003-0117
• DTA SQL Injection: CAN-2003-0118

Tested Versions:

Microsoft tested Microsoft BizTalk Server 2000 and BizTalk Server 2002 to assess whether they are affected by these vulnerabilities.

HTTP Receiver Buffer Overflow

What's the scope of this vulnerability?
This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could cause IIS to fail, or could cause code of the attacker's choice to be executed with system privileges. Code running with system privileges could provide the attacker with the ability to take any desired action on the machine, such as adding, deleting, or modifying data on the system, and creating or deleting user accounts.

What causes the vulnerability?
The vulnerability results because of an unchecked buffer in the BizTalk Server 2002 HTTP Receiver function.

What is the BizTalk Server 2002 HTTP Receiver?
One of BizTalk Server's primary functions is its use to transfer business documents between back end business systems. A number of different document receive functions are available including file transfer, SMTP and MSMQ. BizTalk Server 2002 introduced the ability to use HTTP as a document transfer protocol - this is enabled using the HTTP Receiver function, which is implemented as an ISAPI extension.
The HTTP receiver is not enabled by default and must be explicitly selected as an option when initially setting up a BizTalk site.

What's an ISAPI Extension?
ISAPI (Internet Services Application Programming Interface) is a technology that enables developers to extend the functionality provided by an IIS server. An ISAPI extension is a dynamic link library (.dll) that uses ISAPI to provide a set of web functions above and beyond those natively provided by IIS. When a user needs to use one of the functions that an ISAPI extension exposes, they send a request to the server. It's possible in some cases to call an ISAPI extension directly, but it's more common for users to request files on the server that contain commands to be processed. When a user requests such a file, IIS determines which ISAPI extension should be used to parse the file by consulting a table of script mappings that list the file extensions associated with each ISAPI extension on the server.

What's wrong with the BizTalk Server HTTP Receiver?
There is a flaw in the BizTalk Server ISAPI extension used to receive HTTP documents - known as the HTTP receiver. As a result, it is possible to cause a buffer overrun condition by sending a specially malformed request to the HTTP receiver.

What could this vulnerability enable an attacker to do?
This vulnerability could enable an attacker to run code of his or her choice in the security context of the IIS Server hosting the ISAPI extension. By default IIS 5.0 runs under a user account

How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by sending a specially malformed request to the HTTP Receiver. This request could cause a buffer overflow condition that would allow the attacker to execute code of his or her choice on the server.

What does the patch do?
The patch eliminates the vulnerability by ensuring that the HTTP Receiver carries out the correct input validation checks.

DTA SQL Injection

What's the scope of this vulnerability?
This is a SQL injection vulnerability could enable an attacker to take action on the BizTalk SQL database, as well as potentially allowing an attacker to run operating system commands on it depending on the permission of the DTA user who executed the injected SQL statements. Although the vulnerability would give the attacker control over the database, it would only provide limited privileges at the operating system level.
This vulnerability affects both BizTalk Server 2000 and BizTalk Server 2002.

What causes the vulnerability?
The vulnerability results because of incomplete input parameter validation on one of the web pages used in the Document Tracking & Administration web site.

What's the Document Tracking & Administration (DTA) web site?
The DTA website is a website provided to allow administrators to track & administer documents that are being processed by BizTalk server. It allows BizTalk administrators to build queries that will run against the BizTalk tracking database via a web based tool.
By default the DTA website is restricted to members of the "BizTalk Server Report Users" security group. In order to execute queries against the database, an individual must also have the "dta_ui_role" role assigned in the BizTalk SQL database.

What's SQL Injection?
The easiest way to explain SQL Injection is via a scenario. Suppose a web site hosted an application that allowed visitors to the site to search an online database for particular words. If that application operated by simply taking whatever input a user provided, inserting it into a database query, and running the query, it could be possible for an attacker to provide SQL statements instead of text. The result would be that when the web application ran its query, the attacker's commands would be executed as part of this query. This type of vulnerability is known as a SQL Injection.

What's wrong with the DTA website?
Several of the web pages that are part of the DTA website do not carry out correct input validation. Since these pages retrieve information from the URL query string and use it to query the database, an attacker could send a specially crafted URL query string to a legitimate DTA user - if the user were to then navigate to this URL he or she could execute a malicious embedded SQL statement in the query string against the database.

What could an attacker do via the vulnerability?
By exploiting the SQL injection vulnerability an attacker could modify the database query that is submitted to the BizTalk tracking database. This would give the attacker the ability to insert malicious SQL commands embedded in a URL that would be passed to the database.

What commands could be passed to the operating system?
The level of commands that could be passed to the operating system would be proportionate to the level of permissions that the DTA User had on the server hosting the SQL database. DTA users are usually not highly privileged users since they are only required to be members of "BizTalk Server Report Users" security group in order to use DTA web interface. Therefore a user is likely to have very limited permissions to the SQL Server.
However if the user was a systems administrator for the SQL database then the attacker would have the same level of permissions as the user. This could allow an attacker to execute commands on the operating system.

Who could exploit the vulnerability?
Anyone can attempt to craft an URL query string containing malicious SQL statements for the DTA website, however this query string must be executed by a DTA user in order for an attack to be effective.

How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by specially crafting a URL and then either sending that URL to a user, or posting it to a website. If the user were to then navigate to the URL, SQL contained in the URL could be injected into the affected web pages in the DTA Website.

Could an attacker just simply copy the web page from any BizTalk server and run it against the BizTalk tracking database?
No, this would not work as the attack requires knowledge of the security information used to connect the IIS web server that the DTA web site is running on to the BizTalk tracking SQL database. An attacker would not be able to gain access to this information unless they had been granted permissions to the IIS Server such as having existing permission on the SQL database.

What does the patch do?
The patch ensures that the affected web page in the DTA website carries out the correct input validation checks.

Download locations for this patch

• Microsoft BizTalk Server 2000:

  http://www.microsoft.com/downloads/details.aspx?FamilyId=001E93E4-0E6E-4289-AEFE-9161D2E5AF97&displaylang=en

• Microsoft BizTalk Server 2002:

  http://www.microsoft.com/downloads/details.aspx?FamilyId=A05344FE-2622-4887-AA45-3DE7C4ED3C75&displaylang=en