I think that's what this is about: - Microsoft Security Bulletin MS99-019, Workaround Available for "Malformed HTR Request" Vulnerability (The Web-posted version of this bulletin), http://www.microsoft.com/security/bulletins/ms99-019.asp. - IIS Security Checklist, http://www.microsoft.com/security/products/iis/CheckList.asp ----- Original Message ----- From: James Strompolis <jimst@ENTERACT.COM> To: <WINNT-L@PEACH.EASE.LSOFT.COM> Sent: Tuesday, June 15, 1999 21:42 Subject: ALERT - Really bad IIS4.0 security flaw > This has been on all of the security lists. If you're running IIS4.0, take > a look. > > James Strompolis > Aleph Consultants, Inc. > jimst@enteract.com, http://www.ribs.com > > > ----- Original Message ----- > From: eEye - Digital Security Team <eeye@eeye.com> > To: <BUGTRAQ@NETSPACE.ORG> > > > > > Retina vs. IIS4, Round 2 > > > > Systems Affected: > > > > Internet Information Server 4.0 (IIS4) > > Microsoft Windows NT 4.0 SP3 Option Pack 4 > > Microsoft Windows NT 4.0 SP4 Option Pack 4 > > Microsoft Windows NT 4.0 SP5 Option Pack 4 > > > > Release Date: > > > > June 8, 1999 > > > > Advisory Code: > > > > AD06081999 > > > > Description: > > > > We have been debating how to start out this advisory. How do you explain > > that 90% or so of the Windows NT web servers on the Internet are open to a > > hole that lets an attacker execute arbitrary code on the remote web > server? > > So the story starts... > > > > The Goal: > > > > Find a buffer overflow that will affect 90% of the Windows NT web servers > on > > the Internet. Exploit this buffer overflow. > > > > The Theory: > > > > There will be overflows in at least one of the default IIS filtered > > extensions (i.e. .ASP, .IDC, .HTR). The way we think the exploit will > take > > place is that IIS will pass the full URL to the DLL that handles the > > extension. Therefore if the ISAPI DLL does not do proper bounds checking > it > > will overflow a buffer taking IIS (inetinfo.exe) with it and allow us to > > execute arbitrary code on the remote server. > > -------------------------------------------------------------------------- The WINNT-L list is hosted on a Windows NT(TM) machine running L-Soft international's LISTSERV(R) software. For subscription/signoff info and archives, see http://peach.ease.lsoft.com/archives/winnt-l.html.
Related pages