Microsoft IIS Various Domain User Account Access Vulnerability

Bugtraq ID:	2719
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 14 2001 12:00AM
Updated:	May 14 2001 12:00AM
Credit:	Posted in a Microsoft Security Bulletin MS01-026 on May 14, 2001.
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS Various Domain User Account Access Vulnerability

Microsoft IIS contains a flaw in the handling of FTP domain authentication.

A user attempting to authenticate using a valid login name appended with specially chosen characters, will not be required to specify the domain which the account belongs. The FTP service will instead search the domain and all trusted domains for the user account. Once the account is located, the user will have to complete the authentication process. At this point brute force attacks can be used in an attempt to gain access to the domain.

Microsoft IIS Various Domain User Account Access Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft IIS Various Domain User Account Access Vulnerability

Solution:
Microsoft has released a patch which rectifies this issue:


Microsoft IIS 4.0

• Microsoft Q295534
  http://download.microsoft.com/download/winntsp/Patch/q293826/NT4/EN-US /Q295534i.exe


• Microsoft Q295534
  Install both IIS 4.0 patches.
  http://download.microsoft.com/download/winntsp/Patch/q293826/NT4/EN-US /Q295534is.exe

Microsoft IIS 5.0

• Microsoft Q293826
  http://download.microsoft.com/download/win2000platform/Patch/q293826/N T5/EN-US/Q293826_W2K_SP3_x86_en.EXE

Microsoft IIS Various Domain User Account Access Vulnerability

References:

• Microsoft Security Bulletin MS02-026 (Microsoft)