Microsoft IIS 4.0 IISADMPWD Proxied Password Attack

Bugtraq ID:	2110
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 09 1998 12:00AM
Updated:	Feb 09 1998 12:00AM
Credit:	Posted to BugTraq on February 9, 1998 by David Litchfield <[email protected]>
Vulnerable:	Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS 4.0 IISADMPWD Proxied Password Attack

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft IIS 4.0 IISADMPWD Proxied Password Attack

Solution:
Microsoft refers to this as a feature for network administrators, but do point out in article Q184619 that it is a potential security risk. According to the article, "You can configure a site to support password changes by setting the following properties on the site: PasswordCacheTTL, PasswordChangeFlags and PasswordExpirePrenotifyDays. Refer to the IIS documentation for more details on these properties." It may be prudent to disable this feature if it is accessible by untrusted machines.

Microsoft IIS 4.0 IISADMPWD Proxied Password Attack

References:

• Q184619 - How to Change Windows NT Account Passwords Using Internet Information (Microsoft)