Microsoft Internet Information Server 5.1 DLL Request Remote Code Execution Vulnerability

Bugtraq ID:	15921
Class:	Boundary Condition Error
CVE:	CVE-2005-4360
Remote:	Yes
Local:	No
Published:	Dec 17 2005 12:00AM
Updated:	Jul 13 2007 03:27PM
Credit:	Discovered by Inge Henriksen <[email protected]>. Jonathan Afek and Adi Sharabani of Watchfire supplied more information and assisted Microsoft with this issue.
Vulnerable:	Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0
Not Vulnerable:

Microsoft Internet Information Server 5.1 DLL Request Remote Code Execution Vulnerability

Microsoft IIS is prone to a remote code-execution vulnerability because the application fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the vulnerable application, which may lead to the complete compromise of affected computers.

This issue affects Microsoft IIS 5.1 running on Windows XP SP2.

Note: this issue was previously reported as a denial-of-service vulnerability. New information from the vendor states that code execution is possible.

Microsoft Internet Information Server 5.1 DLL Request Remote Code Execution Vulnerability

To demonstrate this issue, the following request will crash the application if issued a number of times (four requests will do the trick, according to the author):

http://www.example.xom/_vti_bin/.dll/*\~0

The following proof-of-concept exploit also demonstrates this issue by crashing the application:

• /data/vulnerabilities/exploits/IIS_Mal_URI_Dos.cpp

Microsoft Internet Information Server 5.1 DLL Request Remote Code Execution Vulnerability

Solution:
The vendor released an advisory along with fixes to address this issue. Please see the referenced advisory for more information.


Microsoft IIS 5.1

• Microsoft Security Update for Windows XP (KB939373)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fccbfe90-f838 -47df-8310-352e2fb47132

Microsoft Internet Information Server 5.1 DLL Request Remote Code Execution Vulnerability

References:

• Microsoft IIS Homepage (Microsoft)
  
• Microsoft IIS Remote DoS .DLL Url exploit (Inge Henriksen's Technology Blog)
  
• Microsoft IIS Remote Denial of Service (DoS) .DLL Url exploit ()
  
• ASA-2007-302 MS07-041 Vulnerability in Microsoft Internet Information Services C (Avaya)
  
• Microsoft Security Bulletin MS07-041 (Microsoft)