| Article Title |
16/6/99 |
IIS HTR hole allows attackers to execute arbitrary code
|
|
| |
| Article Summary |
A buffer overflow was discovered in the way IIS (Internet Information Server 4.0) handles HTR requests. This exploit allows a malicious user to execute arbitrary code under the security privileges of the IIS running service (usually the SYSTEM security privilege).
|
|
|
| |
| Article Details |
HTR scripts in IIS are used to allow Windows NT users to change their password via the web. This feature is implemented as a set of .HTR files using the ISAPI extension file ISM.DLL. Somewhere along the line when the URL is passed through to ISM.DLL, proper bounds checking is not performed and the mentioned overflow takes place. The .HTR/ISM.DLL ISAPI filter is installed by default on IIS4 servers, so this exploit works on most IIS servers.
An exploit code that executes arbitrary code can be downloaded from:
http://www.eeye.com/database/advisories/ad06081999/ad06081999-exploit.html (Please notice it is a multi file download, you need more than one file to successfully replicate this exploit)
Microsoft released a temporary workaround for what they call a "Malformed HTR Request" vulnerability. The workaround follows:
- From the desktop, start the Internet Service Manager by clicking Start | Programs | Windows NT 4.0 Option Pack | Microsoft Internet Information Server | Internet Service Manager
- Double-click "Internet Information Server"
- Right-click on the computer name and select Properties
- In the Master Properties drop-down box, select "WWW Service", then click the "Edit" button .
- Click the "Home Directory" tab, then click the "Configuration" button .
- Highlight the line in the extension mappings that contains ".HTR", then click the "Remove" button.
- Respond "yes" to "Remove selected script mapping?" say yes, click OK 3 times, close ISM
A perl script that tests for this vulnerability follows:
#!/usr/bin/perl
use LWP::Simple;
for ($i = 2500; $i <= 3500; $i++) {
warn "$i\n";
get "http://$ARGV[0]/".('a' x $i).".htr";
}
|
|
|
| |
| Additional information |
| This vulnerability was found by: eEye Digital Security Team. The exploit was found by actively probing for buffer overflow exploits in ISAPI modules. We will surely hear about more ISAPI holes discovered by eEye in the near future… |
|
|
| |
|
|