-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
NSFOCUS Security Advisory(SA2003-05)
Topic: Microsoft IIS ssinc.dll Over-long Filename Buffer Overflow Vulnerability
Release Date: 2003-5-30
CVE CAN ID: CAN-2003-0224
NSFOCUS Security Team has found a buffer overflow vulnerability in the way a dynamic linking library (ssinc.dll)that is shipped with Microsoft IIS 4.0/5.0 handles the files it contains. Exploiting the vulnerability local attackers could gain local system privilege.
Microsoft IIS supports SSI(Server Side Include) functionality. ssinc.dll is a SSI interpreter. By default extended name .stm,.shtm and .shtml will be mapped to interpreter(ssinc.dll).
SSI supports "#include" command. Typically it is used as the following:
When handling "#include" command ssinc.dll will first attempt to gain the physical path of the shtml file, so it will copy the URI request to a buffer the size of which is fixed. For example, when requesting the following shtml file: http://iishost/abc/test.shtml
It will copy "/abc/test.shtml" to a buffer the size of which is fixed. Because the length of the shtml filename has not been checked during the copying, it causes a stack buffer overflow.
NSFocus Security Team has found a similar problem. See http://www.nsfocus.net/index.php?act=advisory&do=view&adv_id=17 The corresponding Microsoft Security Bulletin is: http://www.microsoft.com/technet/security/bulletin/ms01-044.asp
This vulnerability occurred before that one.
IIS has checked the over-long shtml filename to avoid buffer overflow, while its method is to shorten the filename to legal length, then attempt to open it. After that ssinc.dll will still use the original URI to finish the copy. Therefore, by creating a WEB file with special length local attackers could bypass the check, then request a shtml file with an over-long filename to cause a buffer overflow, which would cause IIS cease to respond. By carefully crafting the overflow data attackers could run arbitrary code with Local System privilege.
Two conditions are required to carry out the attack:
2002.11.05 Inform vendor about the issue 2003.05.28 Microsoft has issued a Security Bulletin(MS03-018) and the related patch.
Detailed Microsoft Security Bulletin is available at:
Patches are available at:
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0224 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Candidates may change significantly before they become official CVE entries.
This vulnerability was discovered by Ren Guang Yuan of NSFOCUS Security Team.
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE ADVISORY IS NOT MODIFIED IN ANY WAY.
NSFOCUS Security Team <firstname.lastname@example.org> NSFOCUS INFORMATION TECHNOLOGY CO.,LTD (http://www.nsfocus.com)
PGP Key: http://www.nsfocus.com/homepage/research/pgpkey.asc Key fingerprint = F8F2 F5D1 EF74 E08C 02FE 1B90 D7BF 7877 C6A6 F6DA -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE+12Qt1794d8am9toRAmOLAJ4nmkk6m5yq4mhn0AzyiuGm5lOt2QCbBaKj WQLml8XHG18hB0IEG4gq+Pc= =QUiN -----END PGP SIGNATURE-----
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo Delivery co-sponsored by TruSecure oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo FREE 14-DAY TRIAL of New Threat & Vulnerability Notification Service
TruSecure's new IntelliShield(tm) web-based threat and vulnerability service isn't your typical alert service. Supported by TruSecure's vast intelligence resources - including the ICSA Labs - IntelliShield's early warning, analysis, decision support, and threat management tools provide organizations with unmatched intelligence to better protect critical information assets. Experience it for yourself - just click below to begin your FREE, NO OBLIGATION 14-day trial today!