NT IIS ASP Alternate Data Streams Vulnerability

Bugtraq ID:	149
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 01 1998 12:00AM
Updated:	Jul 01 1998 12:00AM
Credit:	This vulnerability was posted to the NT Bugtraq Mailing list on June 30, 1998 by Paul Ashton <[email protected]>
Vulnerable:	Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0 Microsoft Personal Web Server 4.0 + Microsoft NT Option Pack for NT 4.0 0 + Microsoft NT Option Pack for NT 4.0 0 + Microsoft Windows 98 + Microsoft Windows 98 Microsoft Personal Web Server 3.0 + Microsoft NT Option Pack for NT 4.0 0 + Microsoft NT Option Pack for NT 4.0 0 + Microsoft Windows 95 + Microsoft Windows 95 + Microsoft Windows 98 + Microsoft Windows 98 Microsoft Personal Web Server 2.0 + Microsoft FrontPage 97 + Microsoft FrontPage 97 + Microsoft FrontPage 98 + Microsoft FrontPage 98 Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft IIS 3.0 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

NT IIS ASP Alternate Data Streams Vulnerability

Microsoft IIS and other NT webservers contain a vulnerability that allows remote users to obtain the source code for an ASP file. When one appends ::$DATA to an asp being requested, the ASP source will be returned, instead of executing the ASP. For example: http://xyz/myasp.asp::$DATA will return the source of myasp.asp, instead of executing it.

NT IIS ASP Alternate Data Streams Vulnerability

The following proof of concept was provided:

http://xyz/myasp.asp::$DATA

This will cause IIS to disclose the contents of the page, myasp.asp, to an attacker.

NT IIS ASP Alternate Data Streams Vulnerability

Solution:
It is strongly recommended that users of IIS upgrade to the latest version.

Patches for other vendors are available at their repsective web sites.

The following fixes are available:


Microsoft IIS 3.0

• Microsoft iis3fixa.exe
  ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/iis3- datafix/iis3fixa.exe


• Microsoft iis3fixi.exe
  ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/iis3- datafix/iis3fixi.exe

Microsoft IIS 4.0

• Microsoft iis4fixa.exe
  ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/iis4- datafix/iis4fixa.exe


• Microsoft iis4fixi.exe
  ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/iis4- datafix/iis4fixi.exe

NT IIS ASP Alternate Data Streams Vulnerability

References:

• ::$DATA fix for IIS (Cristoph Wille )
  
• Microsoft Security Bulletin (MS98-003) (Microsoft)