Microsoft IIS Cross Site Scripting .shtml Vulnerability

Bugtraq ID:	1595
Class:	Origin Validation Error
CVE:	CVE-2000-0746
Remote:	Yes
Local:	Yes
Published:	Aug 21 2000 12:00AM
Updated:	Jul 11 2009 02:56AM
Credit:	Posted to Bugtraq on Aug 21, 2000 by Georgi Guninski <[email protected]>.
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 alpha - Microsoft Windows NT 4.0 alpha - Microsoft Windows NT 4.0 alpha Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS Cross Site Scripting .shtml Vulnerability

IIS may return content specified by a malicious third party back to a client through the use of specially formed links.

If additional text is appended to a request for a shtml file, the server will generate an error including that text. If this text happens to be client-side scripting, it will be executed in the client's browser and treated as content originating from the server returning the error message (even though the scripting may have originated at another site entirely). This becomes an issue especially if the server specified in the hostile URL is a trusted site, as content from that site may then be granted a higher privilege level than usual.

For example, consider a link off of a page from a hostile website:
<a href="http://TrustedServer/<script>Hostile Code Here</script>.shtml">http://TrustedServer</a>.

If a user clicks on the link specified above, the script will get passed in the http request from the client to TrustedSite. TrustedSite will then return the script as part of the error message. The client, receiving the error page containing the script, will then execute it and assign to it all rights granted to content from TrustedSite.

Update (November 2, 2000): A new variant of this vulnerability has been discovered and is addressed in the re-release of patches described in Microsoft Security Bulletin (MS00-060). Please see 'Solution' for the patches.

Microsoft IIS Cross Site Scripting .shtml Vulnerability

Solution:
The original patches released by Microsoft have been reported to cause the server to consume excessive system resources, resulting in a denial of service. Microsoft has addressed both issues with the following patches:


Microsoft IIS 4.0 alpha

• Microsoft Q260347
  Alpha
  http://download.microsoft.com/download/winntsp/Patch/q260347/NT4ALPHA/ EN-US/crsscr4a.exe

Microsoft IIS 4.0

• Microsoft Q260347
  http://download.microsoft.com/download/winntsp/Patch/Q275657/NT4/EN-US /crsscri.exe


• Microsoft Q260347
  http://download.microsoft.com/download/winntsp/Patch/Q275657/NT4/EN-US /crsscris.exe

Microsoft IIS 5.0

• Microsoft Q275657
  http://download.microsoft.com/download/win2000platform/Patch/Q275657/N T5/EN-US/Q275657_W2K_SP2_x86_en.EXE

Microsoft IIS Cross Site Scripting .shtml Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-060) (Microsoft)
  
• Microsoft Security Bulletin MS02-026 (Microsoft)