Type packetstorm
Reporter Vigilante
Modified 2000-07-15T00:00:00


                                            `"Absent Directory Browser Argument" DoS  
Advisory Code: VIGILANTE-2000003  
Release Date:  
July 15, 2000  
Systems Affected:  
Internet Information Server 4.0 for NT (upgraded from IIS 3.0)  
Internet Information Server 5.0 for NT (upgraded from IIS 3.0)  
A system with Internet Information Server 4.0 or 5.0 that was upgraded from  
3.0, contains unused remains from 3.0 due to functionality changes in 4.0.  
Since it's easy to "accidentally" install 3.0 when you install the server,  
there is bound to be quite a few systems out there that haven't cleaned out  
the no longer used scripts and thus are vulnerable.  
Issuing a malformed request for a certain file contained in  
/scripts/iisadmin can result in the webserver going into to an infinite  
loop, causing the web server to no longer accept requests. The service will  
continue to "pick up" on TCP port 80 (or where ever you installed it), but  
will not honour HTTP requests. During testing of this, it was usually  
necessary to reboot the machine in order for IIS to start working again,  
simply attempting to stop and start inetinfo did not work.  
Vendor Status:  
Initially reported on the 24th of May this year. Microsoft has released the  
following bulletin concerning the issue, including a patch:  
Internet Information Server 4.0:  
Internet Information Server 5.0:  
Vendor URL:  
Internet Information Server 4.0 URL:  
Internet Information Server 5.0 URL:  
Copyright VIGILANTe 2000-07-15  
The information within this document may change without notice. Use of  
this information constitutes acceptance for use in an AS IS  
condition. There are NO warranties with regard to this information.  
In no event shall the author be liable for any consequences whatsoever  
arising out of or in connection with the use or spread of this  
information. Any use of this information lays within the user's  
Please send suggestions, updates, and comments to: