Microsoft Windows 2000 Resource Kit W3Who.DLL Multiple Remote Vulnerabilities
BID:11820
Info
Microsoft Windows 2000 Resource Kit W3Who.DLL Multiple Remote Vulnerabilities
| Bugtraq ID: | 11820 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-1133 CVE-2004-1134 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 06 2004 12:00AM |
| Updated: | Jul 12 2009 08:07AM |
| Credit: | Nicolas Gregoire <[email protected]> is credited with the discovery of this issue. |
| Vulnerable: |
Microsoft w3who.dll |
| Not Vulnerable: | |
Discussion
Microsoft Windows 2000 Resource Kit W3Who.DLL Multiple Remote Vulnerabilities
The Microsoft Windows 2000 Resource Kit supports many utilities designed for diagnostic administration of the Windows platform. The w3who.dll library is a utility designed to provide auditing of server configuration remotely through a Web browser.
Multiple remote vulnerabilities affect the w3who.dll library of Microsoft's Windows Resource Kit. These issues are due to a failure of the library to properly sanitize and perform proper bounds checking on user-supplied input.
The first two issues are cross-site scripting vulnerabilities. The final issue is a buffer overflow vulnerability.
These issues may be exploited to conduct cross-site scripting attacks and execute arbitrary code with the privileges of the affected Web server. This may facilitate theft of cookie based authentication credentials, unauthorized access, privileges escalation other attacks.
The Microsoft Windows 2000 Resource Kit supports many utilities designed for diagnostic administration of the Windows platform. The w3who.dll library is a utility designed to provide auditing of server configuration remotely through a Web browser.
Multiple remote vulnerabilities affect the w3who.dll library of Microsoft's Windows Resource Kit. These issues are due to a failure of the library to properly sanitize and perform proper bounds checking on user-supplied input.
The first two issues are cross-site scripting vulnerabilities. The final issue is a buffer overflow vulnerability.
These issues may be exploited to conduct cross-site scripting attacks and execute arbitrary code with the privileges of the affected Web server. This may facilitate theft of cookie based authentication credentials, unauthorized access, privileges escalation other attacks.
Exploit / POC
Microsoft Windows 2000 Resource Kit W3Who.DLL Multiple Remote Vulnerabilities
The following proof of concept exploits have been made available:
XSS vulnerability when displaying HTTP headers :
Connection: keep-alive<script>alert("Hello")</script>
XSS vulnerability in error message :
http://www.example.com/scripts/w3who.dll?bogus=<script>alert("Hello")</script>
Buffer overflow when called with long parameters :
http://www.example.com/scripts/w3who.dll?AAAAAAAAA...[519 to 12571]....AAAAAAAAAAAAA
An exploit for the w3who.dll buffer overflow has been released as part of the MetaSploit Framework 2.3.
The following proof of concept exploits have been made available:
XSS vulnerability when displaying HTTP headers :
Connection: keep-alive<script>alert("Hello")</script>
XSS vulnerability in error message :
http://www.example.com/scripts/w3who.dll?bogus=<script>alert("Hello")</script>
Buffer overflow when called with long parameters :
http://www.example.com/scripts/w3who.dll?AAAAAAAAA...[519 to 12571]....AAAAAAAAAAAAA
An exploit for the w3who.dll buffer overflow has been released as part of the MetaSploit Framework 2.3.
Solution / Fix
Microsoft Windows 2000 Resource Kit W3Who.DLL Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Windows 2000 Resource Kit W3Who.DLL Multiple Remote Vulnerabilities
References:
References:
- Metasploit Framework Exploits (Metasploit)
- Windows 2000 Resource Kit Home Page (Microsoft)
- Multiple vulnerabilities in w3who ISAPI DLL (Nicolas Gregoire