RETIRED: Microsoft IIS FTPd Globbing Functionality Remote Denial of Service Vulnerability

Bugtraq ID:	36276
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 03 2009 12:00AM
Updated:	Sep 04 2009 09:11PM
Credit:	Kingcope
Vulnerable:	Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server
Not Vulnerable:

RETIRED: Microsoft IIS FTPd Globbing Functionality Remote Denial of Service Vulnerability

Microsoft IIS is prone to a denial-of-service vulnerability affecting the application's FTP server.

An attacker can exploit this issue to terminate the affected application, denying service to legitimate users.

This issue affects the following:

IIS 5.0
IIS 6.0

NOTE: This BID is being retired because it is a duplicate of BID 36273 (Microsoft IIS FTPd Globbing Functionality Remote Denial of Service Vulnerability).

RETIRED: Microsoft IIS FTPd Globbing Functionality Remote Denial of Service Vulnerability

The following example command is available:

ls "-R p*/../"

RETIRED: Microsoft IIS FTPd Globbing Functionality Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Microsoft IIS FTPd Globbing Functionality Remote Denial of Service Vulnerability

References:

• Microsoft IIS Homepage (Microsoft)
  
• Microsoft Internet Information Services 5.0/6.0 FTP SERVER DENIAL OF SERVICE (Nikolaos Rangos)
  
• Microsoft Internet Information Services 5.0/6.0 FTP SERVER DENIAL OF SERVICE ('S (Kingcope )