Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2001.185 -- CERT Advisory CA-2001-10 Buffer Overflow Vulnerability in Microsoft IIS 5.0 4 May 2001 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Windows 2000 Server with IIS 5.0 Windows 2000 Advanced Server with IIS 5.0 Windows 2000 Datacenter Server with IIS 5.0 Vendor: Microsoft Operating System: Windows 2000 Impact: Administrator Compromise Access Required: Remote Ref: AL-2001.07 ESB-2001.178 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2001-10 Buffer Overflow Vulnerability in Microsoft IIS 5.0 Original release date: May 02, 2001 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected * Systems running Microsoft Windows 2000 with IIS 5.0 enabled Overview A vulnerability exists in Microsoft IIS 5.0 running on Windows 2000 that allows a remote intruder to run arbitrary code on the victim machine, allowing them to gain complete administrative control of the machine. A proof-of-concept exploit is publicly available for this vulnerability, which increases the urgency that system administrators apply the patch. I. Description Windows 2000 includes support for the Internet Printing Protocol (IPP) via an ISAPI extension. According to Microsoft, this extension is installed by default on all Windows 2000 systems, but it is only accesible through IIS 5.0. The IPP extension contains a buffer overflow that could be used by an attacker to execute arbitrary code in the Local System security context, essentially giving the attacker compete control of the system. This vulnerability was discovered by eEye Digital Security. Microsoft has issued the following bulletin regarding this vulnerability: http://www.microsoft.com/technet/security/bulletin/MS01-023.asp This vulnerability has been assigned the identifier CAN-2001-0241 by the Common Vulnerabilities and Exposures (CVE) group: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0241 II. Impact Anyone who can reach a vulnerable web server can execute arbitrary code in the Local System security context, resulting in the intruder gaining complete control of the system. Note that this may be significantly more serious than a simple "web defacement." III. Solution Apply a patch from your vendor A patch is available from Microsoft at http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29321 Additional advice on securing IIS web servers is available from http://www.microsoft.com/technet/security/iis5chk.asp http://www.microsoft.com/technet/security/tools.asp Appendix A. Vendor Information Microsoft Corporation The following documents regarding this vulnerability are available from Microsoft: http://www.microsoft.com/technet/security/bulletin/MS01-023.asp References 1. VU#516648: Microsoft Windows 2000/Internet Information Server (IIS) 5.0 Internet Printing Protocol (IPP) ISAPI contains buffer overflow, CERT/CC, 05/02/2001, http://www.kb.cert.org/vuls/id/516648 Authors: Chad Dougherty, Shawn Hernan. ______________________________________________________________________ This document is available from: http://www.cert.org/advisories/CA-2001-10.html ______________________________________________________________________ CERT/CC Contact Information Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/ To subscribe to the CERT mailing list for advisories and bulletins, send email to majordomo@cert.org. Please include in the body of your message subscribe cert-advisory * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. ______________________________________________________________________ NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. _________________________________________________________________ Conditions for use, disclaimers, and sponsorship information Copyright 2001 Carnegie Mellon University. Revision History May 02, 2001: Initial Release - -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQCVAwUBOvCEtQYcfu8gsZJZAQG11QP+Ipbm1xOc1d0fiY6KbQefsvBVbUDKdwFk jN2mBm9BM28lniyxvP2Jhbw5vt/6vxFlYKnXF7jQvuw5VpHSPkOs+zuQamt15a0u 3rd4l2nWgRFo10vaykFPYLYjjpfW0BOz5ULkkgKwjbswDQfQQ00o9EurXDXOt276 9pPCMThcy4Q= =eVKj - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBOvKbuSh9+71yA2DNAQHlugP6AtZfcW7y2DWwF7bGih+z4VJ9sszHSVu8 S52VtlmGfHJqygbDbox05PYtD7FpV8qZ3wRwArbUm4wvUpvTUlg/9A/oloBivrCW 3bWU68bTTaSq7C3GysPLf7bbn6Dz1QnDGMfTvna6Pf2zZ0B6mOLGej44UQl8fKzk 1AVMmaEPo50= =VU8V -----END PGP SIGNATURE-----