WelcomeEnterpriseSmall BusinessHome & Home OfficePartnersAbout Symantec

Multiple Microsoft IIS Vulnerabilities

Risk
High

Date Discovered
10-30-2002

Description
Microsoft Internet Information Services (IIS) is prone to multiple vulnerabilities.

The first vulnerability may allow an attacker to obtain elevated privileges. This vulnerability can be exploited by an attacker to load and execute applications on the vulnerable server with SYSTEM level privileges. This vulnerability can exploited when IIS is configured to run applications out of process.

The second vulnerability may allow a remote attacker to cause a denial of service condition. This vulnerability is related to how IIS allocates memory for WebDAV requests. Any specially crafted WebDAV requests may result in IIS allocating an extremely large amount of memory on the server. Several malformed requests sent to the server will result in the vulnerable system failing to respond to further legitimate requests for service. This vulnerability affects IIS 5.0 and 5.1 only.

The third vulnerability may allow a remote attacker to upload a file onto the vulnerable server and possibly execute it. The vulnerability is a result of inappropriate listing of file types that are subject to the script source access permission in IIS 5.0. As a result an attacker may be able to upload malicious files to a vulnerable server and possibly execute it. This vulnerability only affects IIS 5.0.

The final vulnerability is a cross site scripting vulnerability. The vulnerability is a result of improper sanitization of user-supplied input by IIS. Several web pages, provided by IIS for administrative purposes do not adequately sanitize user-supplied input. Any malicious HTML code that may be included in the URI will be executed.

Platforms Affected
Cisco Building Broadband Service Manager 5.0
Cisco Call Manager 1.0
Cisco Call Manager 2.0
Cisco Call Manager 3.0
Cisco ICS 7750
Cisco IP/VC 3540
Cisco Unity Server 2.0
Cisco Unity Server 2.2
Cisco Unity Server 2.3
Cisco Unity Server 2.4
Cisco uOne 1.0
Cisco uOne 2.0
Cisco uOne 3.0
Cisco uOne 4.0
Microsoft BackOffice 4.0
Microsoft BackOffice 4.5
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Advanced Server SP1
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Datacenter Server SP1
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Professional SP1
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Server
Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Server SP2
Microsoft Windows NT 4.0 Option Pack
Microsoft Windows XP 64-bit Edition
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows XP Home
Microsoft Windows XP Home SP1
Microsoft Windows XP Professional
Microsoft Windows XP Professional SP1

Components Affected
Microsoft IIS 4.0
Microsoft IIS 5.0
Microsoft IIS 5.1

Recommendations
Block external access at the network boundary, unless service is required by external parties.
For services not meant for public use, restrict access to trusted hosts and networks only.

Disallow anonymous access to services. Permit access for trusted individuals only.
Do not allow unknown or untrusted individuals to upload files onto critical or sensitive systems.

Do not follow links provided by unknown or untrusted sources.
Be extremely cautious before following any links from suspicious or unknown sources.

Modify default configuration files, to disable any unwanted behaviour.
Delete any sample files and directories that may be installed by default.

Fixes available:


Microsoft IIS 4.0:

Microsoft Patch Q327696: Internet Information Services Security Roll-up Package
http://www.microsoft.com/ntserver/nts/downloads/security/q327696/

Microsoft IIS 5.0:
Microsoft Patch Q327696: Internet Information Services Security Roll-up Package
http://www.microsoft.com/windows2000/downloads/security/q327696/

Microsoft IIS 5.1:
Microsoft Patch Q327696: Internet Information Services Security Roll-up Package
http://download.microsoft.com/download/whistler/Patch/Q327696/WXP/EN-US/Q327696_WXP_SP2_x86_ENU.exe
Microsoft Patch Q327696: Internet Information Services Security Roll-up Package
http://download.microsoft.com/download/whistler/Patch/Q327696/W64XP/EN-US/Q327696_WXP_SP2_ia64_ENU.exe

References
Source: Microsoft Security Bulletin MS02-062
URL: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-062.asp

Credits
Li0n of A3 Security Consulting Co., Ltd. ( http://www.a3sc.co.kr), Mark Litchfield of Next Generation Security Software Ltd. (http://www.nextgenss.com), and Luciano Martins of Deloitte & Touche Argentina (http://www.deloitte.com.ar) are credited for these issues.


Copyright (c) 2002 by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from symsecurity@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and SymSecurity are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.