Microsoft Windows Media Services contains buffer overflow in "nsiislog.dll"

Overview

Microsoft Windows Media Services provides streaming audio and video capabilities. A vulnerability in a component of this software could allow a remote attacker to compromise the server running it.

Description

According to Microsoft Security Bulletin MS03-022:

Microsoft Windows Media Services is a feature of Microsoft Windows 2000 Server, Advanced Server, and Datacenter Server and is also available in a downloadable version for Windows NT 4.0 Server. Windows Media Services contains support for a method of delivering media content to clients across a network known as multicast streaming. In multicast streaming, the server has no connection to or knowledge of the clients that may be receiving the stream of media content coming from the server. To facilitate logging of client information for the server, Windows 2000 includes a capability specifically designed to enable logging for multicast transmissions.

This logging capability is implemented as an Internet Services Application Programming Interface (ISAPI) extension nsiislog.dll. When Windows Media Services are added through add/remove programs to Windows 2000, nsiislog.dll is installed in the Internet Information Services (IIS) Scripts directory on the server. Once Windows Media Services is installed, nsiislog.dll is automatically loaded and used by IIS.

A buffer overflow flaw exists in the way that nsiislog.dll processes incoming client requests. This flaw results in a vulnerability because an attacker could send the server a maliciously crafted HTTP request that could execute code on the vulnerable server or could cause IIS to fail.

This vulnerability is not believed to immediately affect servers running Windows Media Services as a stand-alone service outside the context of IIS. Since the nsiislog.dll file is not available as an ISAPI extension in this environment, an attacker would not be able to supply data to it in a way that exploits the buffer overflow error. The CERT/CC still encourages sites employing this configuration to apply the remediation steps described below in order to mitigate other potential exploitation vectors.

---

Impact

A remote attacker may be able to execute arbitrary code in the context of the account under which IIS was running. This access could be leveraged by the attacker to take any action on the system.

---

Solution

Microsoft has released patches for this issue. Users are encouraged to review Microsoft Security Bulletin MS03-022 for more information.

---

Workarounds

If nsiislog.dll is being used as an ISAPI extension to IIS and its functionality is not required, sites are encouraged to unmap the extension.

---

Vendor Information

113716

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: July 15, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Microsoft has released patches for this issue. Users are encouraged to review Microsoft Security Bulletin MS03-022 for more information.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23113716 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/MS03-022.asp&gt;
• <http://www.microsoft.com/security/security_bulletins/ms03-022.asp&gt;
• <http://support.microsoft.com/default.aspx?scid=kb;en-us;822343&gt;
• <http://www.secunia.com/advisories/9115/&gt;
• <http://securitytracker.com/alerts/2003/Jun/1007059.html&gt;

Acknowledgements

This issue was discovered, researched, and reported to Microsoft by Brett Moore of Security-Assessment.com.

This document was written by Chad R Dougherty.

Other Information

CVE IDs:	CVE-2003-0349
Severity Metric:	19.24 Date Public: