Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability

Bugtraq ID:	1565
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Aug 10 2000 12:00AM
Updated:	Aug 10 2000 12:00AM
Credit:	Discovered by Burt Abreu & Søren Skov of VBExplorer.com.
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 alpha - Microsoft Windows NT 4.0 alpha - Microsoft Windows NT 4.0 alpha Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability

Due to an error in canonicalization affecting CGI scripts and ISAPI extensions, incorrect permissions may be set for a given file on a web server following a malformed HTTP request. This will allow a user to perform actions on CGI or ISAPI-mapped files, including reading or executing, which would normally be denied. This does not apply to files in virtual folders.The correct file is located, but is concluded to be in a location different from its actual folder. Depending on the exact nature of the malformed URL, the file may inherit the permissions of any parent folder in the file's path.

Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability

Solution:
Microsoft has released the following patches which eliminate the vulnerability:


Microsoft IIS 4.0 alpha

• Microsoft Q269862
  http://download.microsoft.com/download/winntsp/Patch/q269862/NT4ALPHA/ EN-US/prmcan4a.exe


• Microsoft Q269862
  http://download.microsoft.com/download/winntsp/Patch/q269862/NT4ALPHA/ EN-US/prmcan4as.exe

Microsoft IIS 4.0

• Microsoft Q269862
  http://download.microsoft.com/download/winntsp/Patch/q269862/NT4ALPHA/ EN-US/prmcan4i.exe


• Microsoft Q269862
  http://download.microsoft.com/download/winntsp/Patch/q269862/NT4ALPHA/ EN-US/prmcan4is.exe

Microsoft IIS 5.0

• Microsoft Q269862
  http://download.microsoft.com/download/win2000platform/Patch/q269862/N T5/EN-US/Q269862_W2K_SP2_x86_en.EXE

Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability

References:

• Microsoft Security Bulletin MS00-057: Frequently Asked Questions (Microsoft)