RETIRED: Microsoft IIS Malformed Local Filename Security Bypass Vulnerability

Bugtraq ID:	37460
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Dec 23 2009 12:00AM
Updated:	Dec 29 2009 09:42PM
Credit:	Soroush Dalili
Vulnerable:	Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft IIS 3.0 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft IIS 2.0 + Microsoft Windows NT 4.0 + Microsoft Windows NT 4.0 Microsoft IIS 1.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:	Microsoft IIS 7.5

RETIRED: Microsoft IIS Malformed Local Filename Security Bypass Vulnerability

Microsoft IIS is prone to a security-bypass vulnerability.

This vulnerability may cause IIS to interpret unexpected files as CGI applications. Attackers may be able to exploit this vulnerability to bypass intended security restrictions.

UPDATE (December 25, 2009): Reports indicate that IIS 7.5 is not vulnerable to this issue. Furthermore, it is currently unknown whether IIS 7.0 is vulnerable.

UPDATE (December 29, 2009): Reports indicate that IIS 5.0 SP1 under Windows XP SP 3 and IIS 7.0 under Windows Server 2008 are not affected.

NOTE: This BID is being retired. For an exploit to succeed, IIS must be configured in a nondefault way and contrary to the vendor's recommended best practices.

RETIRED: Microsoft IIS Malformed Local Filename Security Bypass Vulnerability

An attacker may use readily available tools to carry out an attack.

NOTE: This issue can be exploited using Metasploit Framework's 'msfencode' command.

RETIRED: Microsoft IIS Malformed Local Filename Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: The vendor is currently investigating the vulnerability and will provide additional details later. Please see the references for more information.

RETIRED: Microsoft IIS Malformed Local Filename Security Bypass Vulnerability

References:

• Exploiting Microsoft IIS with Metasploit (Metasploit)
  
• Microsoft IIS 0Day Vulnerability in Parsing Files (semi-colon bug) (Soroush Dalili)
  
• Microsoft IIS Homepage (Microsoft)
  
• New Reports of a Vulnerability in IIS (Microsoft)
  
• Public disclosure of IIS security issue with semi-colons in URL (naziml)
  
• Results of Investigation into Holiday IIS Claim (Microsoft)
  
• Code to mitigate IIS semicolon zero-day ([email protected])
  
• Microsoft IIS 0Day Vulnerability in Parsing Files (semi-colon bug) ([email protected])
  
• Tests about semicolon zero-day (BID 37460) (Crash - DcLabs )