Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability

Bugtraq ID:	27101
Class:	Design Error
CVE:	CVE-2008-0074
Remote:	No
Local:	Yes
Published:	Feb 12 2008 12:00AM
Updated:	Mar 25 2008 06:00PM
Credit:	The vendor reported this issue.
Vulnerable:	Nortel Networks Centrex IP Client Manager 9.0 Nortel Networks Centrex IP Client Manager 10.0 Microsoft IIS 7.0 Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability

Microsoft Internet Information Service (IIS) is prone to a local privilege-escalation vulnerability that occurs when handling file change notifications.

A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability

Solution:
Microsoft has released patches and an advisory to address this issue. Please see the references for more information.


Microsoft IIS 6.0

• Microsoft Security Update for Windows Server 2003 (KB942831)
  http://www.microsoft.com/downloads/details.aspx?familyid=516ef8e8-3cb6 -4660-b771-3c7f66917a11&displaylang=en


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?familyid=5a4a6083-8c67 -4403-8e20-7f2b82178124&displaylang=en


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB942831)
  http://www.microsoft.com/downloads/details.aspx?familyid=e24fb33c-67b9 -4ed4-9317-b5fd535d005a&displaylang=en

Microsoft IIS 7.0

• Microsoft Security Update for Windows Vista (KB942831)
  http://www.microsoft.com/downloads/details.aspx?familyid=8c7018ec-ae80 -4a30-93fc-0f7386732514


• Microsoft Security Update for Windows Vista for x64-based Systems (KB942831)
  http://www.microsoft.com/downloads/details.aspx?familyid=4de2fffc-5793 -4acf-98ee-1b801e59ae39&displaylang=en

Microsoft IIS 5.1

• Microsoft Security Update for Windows XP (KB942831)
  http://www.microsoft.com/downloads/details.aspx?familyid=73d24fcf-bea9 -4b13-9f1c-4e068c53a4ae


• Microsoft Security Update for Windows XP x64 Edition (KB942831)
  http://www.microsoft.com/downloads/details.aspx?familyid=103a6bc0-034a -443d-b1d4-81117820dcb2&displaylang=en

Microsoft IIS 5.0

• Microsoft Security Update for Windows 2000 (KB942831)
  http://www.microsoft.com/downloads/details.aspx?familyid=b24f34fb-40b9 -4aa5-b5ac-e3f0a6062753

Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft IIS Homepage (Microsoft)
  
• ASA-2008-064: MS08-005 Vulnerability in Internet Information Services Could Allo (Avaya)
  
• Centrex IP Client Manager (CICM) Response to Microsoft February 2008 Security Bu (Nortel Networks)
  
• Microsoft Security Bulletin MS08-005 �?? Important (Microsoft)