Microsoft IIS 4.0 Chunked Transfer Encoding Buffer Overflow Vulnerability

Bugtraq ID:	1066
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Mar 20 2000 12:00AM
Updated:	Mar 20 2000 12:00AM
Credit:	Discovered by Petteri Stenius and publicized in Microsoft Security Bulletin (MS00-018) released on March 20, 2000.
Vulnerable:	Microsoft IIS 4.0 alpha - Microsoft Windows NT 4.0 alpha - Microsoft Windows NT 4.0 alpha Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS 4.0 Chunked Transfer Encoding Buffer Overflow Vulnerability

Due to unchecked buffer code that handles chunked encoding transfers, remote users are able to consume CPU cycles in Microsoft IIS until the program is rendered completely unstable and eventually crash. The remote user can request a POST or PUT command using chunked transfer encoding compromised of a large buffer without actually filling it. This can cause the server to hang indefinitely until the remote user cancels the session or until the IIS service is stopped and restarted.

Microsoft IIS 4.0 Chunked Transfer Encoding Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft IIS 4.0 Chunked Transfer Encoding Buffer Overflow Vulnerability

Solution:
Microsoft has released patches which rectify this issue:


Microsoft IIS 4.0 alpha

• Microsoft Q252693
  http://download.microsoft.com/download/iis40/Patch/4.2.739.1/ALPHA/EN- US/chkenc4a.exe

Microsoft IIS 4.0

• Microsoft Q252693
  http://download.microsoft.com/download/iis40/Patch/4.2.739.1/NT4/EN-US /chkenc4i.exe

Microsoft IIS 4.0 Chunked Transfer Encoding Buffer Overflow Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-018) (Microsoft)
  
• Q252693: Chunked Encoding Request with No Data Causes IIS Memory Leak (Microsoft)