Microsoft IIS 4.0/5.0 Source Fragment Disclosure Vulnerability

Bugtraq ID:	1488
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 17 2000 12:00AM
Updated:	Jul 17 2000 12:00AM
Credit:	Zuo Lei was credited in the Microsoft Advisory (MS00-044). Additional information was gained from an advisory submitted by ISBASE.
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 alpha - Microsoft Windows NT 4.0 alpha - Microsoft Windows NT 4.0 alpha Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS 4.0/5.0 Source Fragment Disclosure Vulnerability

Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be inaccessible. This is done by appending "+.htr" to a request for a known .asp (or .asa, .ini, etc) file. Appending this string causes the request to be handled by ISM.DLL, which then strips the +.htr string and may disclose part or all of the source of the .asp file specified in the request. There has been a report that source will be displayed up to the first '<%' encountered - '<%' and '%>' are server-side script delimiters. Pages which use the <script runat=server></script> delimiters instead will display the entire source, or up to any '<%' in the page. This vulnerability is a variant of a previously discovered vulnerability, BugTraq ID 1193.

Microsoft IIS 4.0/5.0 Source Fragment Disclosure Vulnerability

http://victim/global.asa+.htr

Microsoft IIS 4.0/5.0 Source Fragment Disclosure Vulnerability

Solution:
Apply the vendor supplied patches. Disable HTR functionality if you do not need it.


Microsoft IIS 4.0 alpha

• Microsoft Q267559
  http://download.microsoft.com/download/winntsp/Patch/q267559/NT4ALPHA/ EN-US/htrdos4a.exe


• Microsoft Q267559
  http://download.microsoft.com/download/winntsp/Patch/q267559/NT4ALPHA/ EN-US/htrdos4as.exe

Microsoft IIS 4.0

• Microsoft Q267559
  http://download.microsoft.com/download/winntsp/Patch/q267559/NT4ALPHA/ EN-US/htrdos4i.exe


• Microsoft Q267559
  http://download.microsoft.com/download/winntsp/Patch/q267559/NT4ALPHA/ EN-US/htrdos4is.exe

Microsoft IIS 5.0

• Microsoft Q267559
  http://download.microsoft.com/download/win2000platform/Patch/q267559/N T5/EN-US/Q267559_W2K_SP2_x86_en.EXE

Microsoft IIS 4.0/5.0 Source Fragment Disclosure Vulnerability

References:

• Microsoft IIS 4.0/5.0 Malformed Filename Request Vulnerability (SecurityFocus)
  
• Microsoft Security Bulletin (MS00-044): Frequently Asked Questions (Microsoft)