18

Microsoft has just patched a vulnerability in Schannel that could allow remote code execution (MS14-066). What I can't find are any reliable details on how this can be exploited. I've seen some people claim that it can only be exploited if you're running a webserver on Windows. But the german news portal Heise claims that it is also exploitable by visiting websites.

What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update? And if that is the case, does this only apply to IE, or do the other browsers use the vulnerable library as well?

Improve this question
2
  • 1
    Keep in mind that the lack of information is probably deliberate in order to make it harder to craft exploits.
    – GdD
    Nov 12, 2014 at 10:20
  • 1
    The "patch" also adds four new ciphers, interference or coincidence? ;-)
    – mr.spuratic
    Nov 12, 2014 at 10:34

5 Answers 5

Reset to default
13

What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update?

From [Dailydave] More info on SSLMAGEDON:

Our friends at BeyondTrust have a page on the bug now: http://blog.beyondtrust.com/triggering-ms14-066

One thing I think people are missing is that this bug works by default on Windows 7 and above. You can force a client cert down Window's throat, which triggers the vulnerability regardless of configuration settings.

From Assessing Risk for the November 2014 Security Updates:

"Most likely attack vector" [...for MS14-066 is...] "User browses to a malicious webpage."

Note: "User browses to a malicious webpage" was changed to "A malicious user sends specially crafted packets to an exposed service" after I wrote the previous sentence.

Does this only apply to IE, or do the other browsers use the vulnerable library as well?

From the document at TLS/SSL hardening and compatibility Report 2011:

In order to assess the SSL/TLS support of modern Internet browsers we had to take a look at the SSL engines they use. Some SSL stacks generally have capabilities that browsers do not make use of per default, the lists below only reflect real default browser usage.

Chrome and Firefox use the NSS engine

IE5, 6, 7, 8 and Safari use Microsoft SCHANNEL

Opera and Safari (OSX) use custom SSL engines

From Transport Layer Security:

TLS support of Opera 14 and above is same as that of Chrome, because Opera has migrated to Chromium backend

Improve this answer
3
  • "Most likely attack vector" [...for MS14-066 is...] "User browses to a malicious webpage." I quote from the same page: "MS14-066 (SChannel) A malicious user sends specially crafted packets to an exposed service. Critical 1 Internally found during a proactive security assessment." This does not imply IE impact. ... did the page change?
    – user60737
    Nov 13, 2014 at 14:36
  • Microsoft say "if an attacker sends specially crafted packets to a windows server". Qualsys says "both server and client roles".
    – mr.spuratic
    Nov 13, 2014 at 15:11
  • @Laren: Indeed the page did change.
    – MrBrian
    Nov 14, 2014 at 3:08
0

The vulnerability derives from a flaw in SPVerifySignature. If the application being used relies on Schannel.dll, it is very likely that it is vulnerable to the WinShock exploit. Applications using their own SSL implementation are not affected by this.

There is a lot of confusion going on between MS14-066 and MS14-064, the latter of which fixes a vulnerability that can be exploited using a well-crafted VBScript. The former, however, is a different beast entirely, and has some very real and dangerous consequences, regardless of browser choice.

Improve this answer
1
  • The use of the name Winshock for this vulnerability is confusing as windows also suffered from a shellshock variant often called Winshock. It is better to refer to it as the Schannel bug if you insist on naming it.
    – wireghoul
    Nov 14, 2014 at 4:05
0

This vulnerability should be exploitable through any connection that relies on windows SSL libraries on an unpatched machine. A pre-auth remote exploit against rdp will be available to paying customers tomorrow according to this tweet.

Improve this answer
0

No. See below. Microsoft Exchange and Internet Explorer and Edge and all applications all use WinHTTP API. I don't believe most third party browsers pull settings from Schannel, they can also use their own custom crypto api. WINHTTP (internet options) defines internet explorer TLS cipher strength and Min/Max TLS respectively, though WINHTTP/IE components are (even when IE is uninstalled) an embedded part of windows, for example

[Image 1] [Resultant policy of tightened ActiveX GPO] enter image description here Image [2]

Schannel governs CryptoAPI (certificate revocation checks), Windows Update, IIS (windows servers), Terminal Server/Remote Desktop., and possibly others as well. Given it is "remotely executable code", its possible all these components are/were vulnerable. .NET pulls from its own unique TLS settings in the registry unless configured to use system, presumably schannel/group policy settings. [Details 1] [and 2]

Improve this answer
-1

Apparently not if you are visiting that website using Chrome.

I have an old XP laptop that I only use for light browning. On this (live) XP system, I just renamed all copies of "schannel.dll" or "schannel.dl_" on the boot drive, including any ones that kept cropping up in other locations (eg. windows\system32\dllcache or windows\$NTservicepackuninstall$). System seems to still run, I am able to browse (and make this post) with Chrome.. suppose next I will try a reboot and see what happens then....

This link: https://gist.github.com/hmoore-r7/01a2940edba33f19dec3 seems to suggest the patch in a W2k3 system affects this library.. donno really.

Improve this answer
7
  • 1
    I'm not sure how this answers the question.
    – schroeder ♦
    Nov 16, 2014 at 23:22
  • It (like another answer above) seems to suggest visiting a website using Chrome does not open you up to this vulnerability, even on an unpatched (or in the case of XP, unpatchable) machine.. incidentally, the machine survived the reboot as well. Not sure what else removing this library on XP will break.
    – user310495
    Nov 16, 2014 at 23:27
  • 1
    ok but, how have you demonstrated that with your answer? All I see is steps you've taken and the effect on normal browsing.
    – schroeder ♦
    Nov 16, 2014 at 23:29
  • The question was: "Can the Windows Schannel vulnerability be exploited by visiting a website?" I disabled the schannel library. This did not affect browsing with Chrome. Thus I can conclude that browsing with Chrome does not rely on the schannel library. Thus I can conclude that one answer to the question "Can the Windows Schannel vulnerability be exploited by visiting a website?" is "No, not if you are visiting that website using Chrome." Perhaps I will edit the answer!
    – user310495
    Nov 16, 2014 at 23:40
  • Readers have to do a lot of inferring to understand what you are trying to say. Lay it out for them like you did in the comments. That said, it still doesn't answer the question. The OP isn't looking for defense, but for a direction on how to exploit.
    – schroeder ♦
    Nov 17, 2014 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .