Microsoft Internet Information Server (IIS) buffer overflow in server-side includes (SSI) containing long invalid file name

Overview

A buffer overflow in IIS could allow an intruder to execute arbitrary code with the privileges of the ASP.DDL.

Description

Server-side include files (SSI files) are files which reside on a web server and which are included by scripts, programs, or web pages. SSI files are often used to provide common headers or graphics across multiple web pages, or to reuse code in multiple web pages. Web browsers can’t request that a particular file be included, but may be able to influence when and how a file gets included. Quoting from Microsoft Security Bulletin MS02-018:

_In some cases, requesting a particular web page will cause it to be included within an ASP script as part of its processing. Because this involves putting user input into a buffer, IIS always performs a check beforehand, designed to make sure the input is valid. Specifically, it performs an operation on the file name that should only succeed if the file name is valid.

A security vulnerability results because it’s possible to levy a request that includes a very long, invalid file name, but do it in a way that has two effects. First, the ASP ISAPI extension concludes that the filename needs to be processed as part of an ASP file, and does a server-side include. Second, the filename evades the safety check. The result is that the file name – which is longer than the buffer allocated to hold it – causes a buffer overrun in the ASP file when it’s processed. _

In order to exploit the vulnerability, ASP has to be enabled on the server.

---

Impact

An intruder can interrupt the ordinary operation of a vulnerable IIS server or execute arbitrary code with the privileges of ASP ISAPI extension, ASP.DLL. On IIS 4.0, ASP.DLL runs as part of the operating system thus allowing an intruder to take full administrative control. On IIS 5.0 and 5.1, ASP.DLL runs with the privileges of the IWAM__computername_ account.

---

Solution

Apply a patch as described in MS02-018.

---

Until a patch can be applied, you may wish to disable ASP if that is possible in your environment. In general, if ASP (or any service) is not needed, we recommend disabling it. The IIS Lockdown Tool can be used to help you disable ASP.

---

Vendor Information

721963

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft __ Affected

Updated: April 10, 2002

Status

Affected

Vendor Statement

See <http://www.microsoft.com/technet/security/bulletin/ms02-018.asp&gt;.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23721963 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/MS02-018.asp&gt;
• <http://www.microsoft.com/technet/security/tools/locktool.asp&gt;

Acknowledgements

Our thanks to Microsoft Corporation, upon whose advisory this document is based.

This document was written by Shawn V. Hernan.

Other Information

CVE IDs:	CVE-2002-0149
Severity Metric:	48.60 Date Public: