Microsoft Internet Information Services ASP Remote Code Execution Vulnerability

Bugtraq ID:	27676
Class:	Unknown
CVE:	CVE-2008-0075
Remote:	Yes
Local:	No
Published:	Feb 12 2008 12:00AM
Updated:	Feb 15 2008 11:45PM
Credit:	This issue was announced by Microsoft.
Vulnerable:	Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional
Not Vulnerable:

Microsoft Internet Information Services ASP Remote Code Execution Vulnerability

Microsoft Internet Information Services (IIS) is prone to a remote code-execution vulnerability that can be exploited through malicious input to vulnerable ASP pages.

A successful exploit of this vulnerability could let remote attackers execute arbitrary code in the context of the Worker Process Identity, which by default has Network Service privileges.

Microsoft Internet Information Services ASP Remote Code Execution Vulnerability

Proof-of-concept information is available. Please see 'Exploiting IIS via HTMLEncode (MS08-006)' in the references section for more information.

The following proof of concept is available to members of the Immunity Partners Program:

https://www.immunityinc.com/downloads/immpartners/iisasp.py

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Internet Information Services ASP Remote Code Execution Vulnerability

Solution:
Microsoft has released a security bulletin to address this vulnerability. Please see the references for details.


Microsoft IIS 6.0

• Microsoft Security Update for Windows Server 2003 (KB942830)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6583e798-d16d -419c-aee1-30c3e6c635b3


• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB942830)
  http://www.microsoft.com/downloads/details.aspx?familyid=29faa70d-f1ac -4da4-b72a-faf1973cd845


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB942830)
  http://www.microsoft.com/downloads/details.aspx?familyid=e8286174-8209 -409f-8805-e534715a741c


• Microsoft Security Update for Windows XP x64 Edition (KB942830)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=df9875f7-04d6 -486e-bdb5-35e9e305fa1d

Microsoft IIS 5.1

• Microsoft Security Update for Windows XP (KB942830)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=2b498065-d682 -4227-b23e-d234d7d6a3fe

Microsoft Internet Information Services ASP Remote Code Execution Vulnerability

References:

• Exploiting IIS via HTMLEncode (MS08-006) (Strike Center)
  
• Microsoft Security Bulletin MS08-006 (Microsoft)