Report on the MDAC Vulnerability: Attack Vectors and Solutions

This report examines a critical vulnerability discovered in the Microsoft Data Access Components (MDAC) in 2006, which allowed remote attackers to execute code and gain unauthorized access to affected systems, including Windows 98, ME, XP, 2000, and Server 2003. The report details the technical aspects of the vulnerability, the attack vector, and the exploitation scenario, including how attackers could use social engineering and infected web pages to compromise systems. It then outlines effective mitigation strategies such as using Internet Explorer Enhanced Security Configuration, restricting user access, and installing antivirus solutions, alongside remediation techniques like installing Microsoft updates and running security analyzers. The report highlights the impact of the vulnerability and provides a comprehensive overview of how to protect against and address it.

Table of Contents
Executive Summary............................................................................................................1
Technical description.........................................................................................................1
Attack Vector.............................................................................................................................1
Mitigation..................................................................................................................................2
Remediation..............................................................................................................................3
Exploitation Scenario.................................................................................................................3
Executive Summary

A vulnerability was discovered in the first quarter of 2006. The vulnerability was found in the
Microsoft Data Access Components or MDAC. This vulnerability was privately reported to
Microsoft and much of the details surrounding it did not see much publication surrounding it.
Microsoft designated this vulnerability as critical and immediately started working on the
solution. The vulnerability allows an attacker to execute code remotely and gain access to the
computer. This paper talks about the vulnerability and then proceeds to talk about the Attack
Vector. The exploitation scenario will be detailed and will then talk about mitigating the
vulnerability as well as possible remediation techniques.
Technical description
Attack Vector
This vulnerability existed in the Microsoft Data Access Components or MDAC that allowed
remote attackers to execute code remotely. The affected systems include Microsoft 98,
Millennium Edition, Microsoft XP, 2000 as well as Windows Server 2003. However,
Microsoft rated impact severity of Windows Server 2003 as ‘moderate’ instead of ‘critical’
compared to others. In poorly written application that supports MDAC, it would allow
attackers to execute code remotely and exploit this vulnerability fully. If a user is logged in
with Administrator rights in these operating systems, then an attacker who exploited this
vulnerability successfully would completely be able to take control of the system. He could
install programs, change or view data or even delete data and create other accounts among
with a host of other activities. Users whose accounts are configured with less rights may be
less affected than with users with more rights.

Mitigation
The following mitigation factors could be utilized by a user who is at the risk of being
affected by this vulnerability :
 Internet Explorer Enhanced Security Configuration reduces the risk of this
vulnerability significantly. In order to accomplish this, one needs to follow the
following steps :
o Setting the security level of Internet zone to ‘High’. This setting disables
ActiveX, Microsoft Java VM and other scripts as well as file downloads.
o Disabling automatic detection of Intranet sites. In this case, all the intranet
sites that are not explicitly listed in a separate local zone are marked as
Internet zone sites.
o Disable Non-Microsoft browser extensions as well as on-demand browser
extensions. It also prevents web pages to automatically installing components.
o Lastly, the Multimedia content can also be disabled to further prevent this
vulnerability from happening.
 Restrict oneself from visiting unknown websites and unfamiliar websites as the
vulnerability can be placed in infected websites which a user could knowingly click
and download.
 Configuring the user to have as limited access to the system as possible. This is also a
known strategy to mitigate the vulnerability.
 Installing an Antivirus solution that pre-scans the website before delivering to the
end-user and thereby blocking any sites that are deemed harmful or has the said
vulnerability.

Remediation
 Installing the Microsoft update based on the respective system as soon as it’s made
available. (Typically auto-installed, if the updates are set to install automatically).
 Running Microsoft Baseline Security Analyzer to check for any known vulnerabilities
or security mis-configuration.
 Enabling ‘Enhanced Security Configuration’ in Internet Explorer and also disabling
ActiveX controls.
 By making sure an Antivirus such as Microsoft Security Essentials / Defender and
Windows Firewall are configured, receiving updates and currently active.
 By restricting one-self from visiting unknown websites and unfamiliar websites as the
vulnerability can be placed in infected websites which a user could knowingly click
and download.
Exploitation Scenario
1. In a Web-based scenario, the attacker would host a website that would contain a web-
page infected with this known vulnerability
2. Attacker would have no way of forcing the user and hence has to make use of social
engineering tactics for luring the users to the website.
3. The infected web-page would typically be loaded after following a link placed in
Email, Document or another website on the internet.
4. The attacker could then further infect a file with the malicious content and would lure
the user with for example a banner advertisements to deliver the infected file to the
user’s computer.

5. As soon as the user clicks on the file and downloads it, the attacker would be able to
gain the same rights to the system as that of the user. If the user is an admin, then
system could be compromised greatly by the attacker.å