7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.408 Medium
EPSS
Percentile
97.3%
A vulnerability exists in Microsoft Internet Information Server (IIS) which could disclose sensitive information contained in CGI-type files. Typically a CGI/script file on a web server should only be executable and not readable by remote users. Sensitive information contained in such a file might include user credentials for access to a back-end database.
IIS contains a technology called ISAPI (Internet Services Application Programming Interface) which is designed to allow programmers to write custom applications which run on IIS. One ISAPI extension uses .HTR scripts to provide a password management interface via IIS. The .HTR ISAPI extension is implemented in the file ISM.DLL
. When IIS receives a request for a file ending in .HTR it performs some pre-processing of the request then passes it off to ISM.DLL
. If a malicious user crafts an HTTP request for an existing non-.HTR file and appends a large number of β%20β characters and β+.HTRβ to the request, ISM.DLL
strips out the spaces in the file name and processes the requested file as if it were an .HTR file. Note that β%20β is a unicode representation of the character " " (space). If the requested file is not an .HTR file then the contents of the file will be returned to the requestor, with the exception of text enclosed in script delimiters β<% %>β.
Microsoft Knowledge Base article Q260069 states:
The problem occurs because the CreateFile function that is used to open requested files deletes all of the trailing spaces in a file name. The file-name truncation in the CreateFile function causes the two names βC:\Ineptub\Wwroot\Default.aspβ and βC:\Ineptub\Wwroot\Default.asp<followed by several blank spaces>β to be the same, which causes the source code of the Default.asp file to be opened and be returned.
In order for this vulnerability to be exploited, specific locations in memory must contain zeros. Memory is zeroed as part of the initialization process, so the server would be most vulnerable soon after the IIS service was started and possibly up to the point at which the .HTR ISAPI code was first loaded into memory. Once the .HTR ISAPI code has been loaded and memory has been βdirtied,β the chances that an exploit attempt will succeed are notably reduced.
The contents of files may be disclosed to unauthorized remote users. Target files may be CGI scripts that contain sensitive configuration information such as database access credentials. This specific vulnerability does not allow an attacker to access files located outside the root directory of the web server.
Disable .HTR script mapping if not needed, as described in Microsoft Security Bulletin MS01-004:
1.\tOpen the Internet Services Manager
2.\tRight-click the web server, then choose Properties, then Master Properties, then WWW Service.
3.\tChoose Edit, then HomeDirectory, then Configuration
4.\tRemove the .HTR entry
Itβs worth noting that, in addition to .HTR, Microsoft also recommends removing several other so-called script mappings.
Apply the appropriate vendor patch:
IIS 4.0: <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=27492>
IIS 5.0: <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=27491>
Note that these are the most recent patches as referenced in MS01-004.
CERT/CC also recommends the following documents on the secure configuration of Windows NT/2000 and IIS:
Windows NT Configuration Guidelines
Windows NT Security and Configuration Resources
IIS 4.0 Security Checklist
Secure Internet Information Services 5 Checklist
It may be possible to use an application layer filter to detect and block malicious requests.
35085
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: June 15, 2001
Affected
Microsoft has released Microsoft Security Bulletin MS00-031.
The vendor has not provided us with any further information regarding this vulnerability.
Note that there are two other variants of this vulnerability which are described in VU#28565/MS00-044 and VU#28565/MS01-004 respectively.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%2335085 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
The CERT Coordination Center acknowledges and thanks David Litchfield of Cerberus Information Security/@Stake and Microsoft Product Security for information used in this document.
This document was written by Art Manion.
CVE IDs: | CVE-2000-0457 |
---|---|
Severity Metric: | 13.17 Date Public: |