{"id": "VU:264272", "type": "cert", "bulletinFamily": "info", "title": "Microsoft Internet Information Server (IIS) discloses contents of files via crafted request containing \"%3F+.htr\"", "description": "### Overview\n\nA vulnerability exists in Microsoft Information Server (IIS) in which a crafted HTTP GET request may return the contents of a file on the affected server. A possible target of such a request might be a script that should only be executable (not readable) by unauthenticated remote users. The contents of such a file might contain sensitive information such as user credentials for access to a back-end database.\n\nThis is a variation of the vulnerability discussed in VU#35085 and Microsoft Security Bulletin [MS00-031](<http://www.microsoft.com/technet/security/bulletin/MS00-031.asp>) and more recently in VU#28565 and Microsoft Security Bulletin [MS00-044](<http://www.microsoft.com/technet/security/bulletin/MS00-044.asp>).\n\n### Description\n\nIIS contains a technology called ISAPI (Internet Services Application Programming Interface) which is designed to allow programmers to write custom applications which run on IIS. One ISAPI extension uses .HTR scripts to provide a password management interface via IIS. The .HTR ISAPI extension is implemented in the file `ISM.DLL`. When IIS receives a request for a file ending in .HTR it performs some pre-processing of the request then passes it off to `ISM.DLL`. If a malicious user crafts an HTTP request for an existing non-.HTR file and appends \"%3F+.HTR\" to the request then the requested file will be processed as if it were an .HTR file. Note that \"%3F\" is a unicode representation of the character \"?\". If the requested file is not an .HTR file, then the contents of the file will be returned to the requestor, with the exception of text enclosed in script delimiters \"&lt;% %&gt;\". \nIn order for this vulnerability to be exploited, specific locations in memory must contain zeros. Memory is zeroed as part of the initialization process, so the server would be most vulnerable soon after the IIS service was started and possibly up to the point at which the .HTR ISAPI code was first loaded into memory. Once the .HTR ISAPI code has been loaded and memory has been \"dirtied,\" the chances that an exploit attempt will succeed are notably reduced. \n \n--- \n \n### Impact\n\nThe contents of files may be disclosed to unauthenticated remote users. Target files may be CGI scripts that contain sensitive configuration information such as database access credentials. This specific vulnerability does not allow an attacker to access files located outside the root directory of the web server. \n \n--- \n \n### Solution\n\nDisable .HTR script mapping if not needed, as described in Microsoft Security Bulletin [MS01-004](<http://www.microsoft.com/technet/security/bulletin/MS01-004.asp>): \n1.\\tOpen the Internet Services Manager \n2.\\tRight-click the web server, then choose Properties, then Master Properties, then WWW Service. \n3.\\tChoose Edit, then HomeDirectory, then Configuration \n4.\\tRemove the .HTR entry \nIt\u2019s worth noting that, in addition to .HTR, Microsoft also recommends removing several other so-called script mappings. \n \nApply the appropriate vendor patch: \nIIS 4.0: <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=27492> \nIIS 5.0: <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=27491> \nNote that these are the most recent patches as referenced in [MS01-004](<http://www.microsoft.com/technet/security/bulletin/MS01-004.asp>). \n \nCERT/CC also recommends the following documents on the secure configuration of Windows NT/2000 and IIS. \n[Windows NT Configuration Guidelines](<http://www.cert.org/tech_tips/win_configuration_guidelines.html>) \n[Windows NT Security and Configuration Resources](<http://www.cert.org/tech_tips/win-resources.html>) \n[IIS 4.0 Security Checklist](<http://www.microsoft.com/technet/security/iischk.asp>) \n[Secure Internet Information Services 5 Checklist](<http://www.microsoft.com/technet/security/iis5chk.asp>) \n \n--- \n \n[](<http://www.microsoft.com/technet/security/bulletin/MS01-004.asp>)It may be possible to use an application layer filter to detect and block malicious requests. \n \n--- \n \n### Vendor Information\n\n264272\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Additional information available\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n**Javascript is disabled. Click here to view vendors.**\n\n### Microsoft __ Affected\n\nUpdated: June 15, 2001 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nMicrosoft has released [Microsoft Security Bulletin MS01-004](<http://www.microsoft.com/technet/security/bulletin/ms01-004.asp>).\n\n### Vendor Information \n\nThe vendor has not provided us with any further information regarding this vulnerability.\n\n### Addendum\n\nNote that there are two other variants of this vulnerability which are described in VU#35085/[MS00-031](<http://www.microsoft.com/technet/security/bulletin/ms00-031.asp>) and VU#28565/[MS01-004](<http://www.microsoft.com/technet/security/bulletin/ms01-004.asp>) respectively.\n\nIf you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:cert@cert.org?Subject=VU%23264272 Feedback>).\n\n \n\n\n### CVSS Metrics\n\nGroup | Score | Vector \n---|---|--- \nBase | | \nTemporal | | \nEnvironmental | | \n \n \n\n\n### References\n\n * <http://www.securityfocus.com/bid/2313>\n * <http://www.microsoft.com/technet/security/bulletin/MS01-004.asp>\n\n### Acknowledgements\n\nThe CERT Coordination Center thanks Georgi Guninski and Microsoft Product Security for information used in this document.\n\nThis document was written by Art Manion.\n\n### Other Information\n\n**CVE IDs:** | [CVE-2001-0004](<http://web.nvd.nist.gov/vuln/detail/CVE-2001-0004>) \n---|--- \n**Severity Metric:** | 13.17 \n**Date Public:** | 2001-01-08 \n**Date First Published:** | 2001-06-15 \n**Date Last Updated: ** | 2001-08-07 13:09 UTC \n**Document Revision: ** | 30 \n", "published": "2001-06-15T00:00:00", "modified": "2001-08-07T13:09:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "href": "https://www.kb.cert.org/vuls/id/264272", "reporter": "CERT", "references": ["http://www.securityfocus.com/bid/2313", "http://www.microsoft.com/technet/security/bulletin/MS01-004.asp"], "cvelist": ["CVE-2001-0004"], "immutableFields": [], "lastseen": "2021-09-28T17:54:31", "viewCount": 7, "enchantments": {"score": {"value": 6.3, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2001-0004"]}], "rev": 4}, "backreferences": {"references": [{"type": "cert", "idList": ["VU:35085"]}, {"type": "cve", "idList": ["CVE-2001-0004"]}]}, "exploitation": null, "vulnersScore": 6.3}, "_state": {"dependencies": 1645428665}}

{"cve": [{"lastseen": "2022-03-23T12:19:52", "description": "IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending \"%3F+.htr\" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the \"File Fragment Reading via .HTR\" vulnerability.", "cvss3": {}, "published": "2001-02-12T05:00:00", "type": "cve", "title": "CVE-2001-0004", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2001-0004"], "modified": "2018-10-30T16:25:00", "cpe": ["cpe:/a:microsoft:internet_information_services:5.0", "cpe:/a:microsoft:internet_information_server:4.0"], "id": "CVE-2001-0004", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0004", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*"]}]}