Microsoft IIS And PWS 8.3 Directory Name Vulnerability

Bugtraq ID:	582
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Aug 16 1999 12:00AM
Updated:	Aug 16 1999 12:00AM
Credit:	Posted to Bugtraq on August 16, 1999 by x-empt [ lvhc / lou ] <[email protected]>.
Vulnerable:	Microsoft Personal Web Server 4.0 + Microsoft NT Option Pack for NT 4.0 0 + Microsoft NT Option Pack for NT 4.0 0 + Microsoft Windows 98 + Microsoft Windows 98 Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS And PWS 8.3 Directory Name Vulnerability

32bit Windows operating systems support long filenames, but also offer a means of compatibility with the older 8.3 filenames required by previous versions of DOS and Windows. This leads to problems with programs that have their own internal file security mechanisms. In Microsoft's IIS and PWS, requesting the 8.3 version of a file or directory effectively bypasses the security attributes that are referenced to the full, long version of the filename, with permissions being based instead on those of the parent directory.

Successful exploitation of this vulnerability could lead not only to unauthorized directory listings, disclosure of arbitrary files, but also to the remote execution of 'protected' scripts.

Microsoft IIS And PWS 8.3 Directory Name Vulnerability

This issue can be exploited using a web browser.

Microsoft IIS And PWS 8.3 Directory Name Vulnerability

Solution:
Various solutions exist:

In tests on NT based systems, applying SP4 or SP5 has fixed this issue. Be sure to re-apply the appropriate service pack after installing other software, as some systems that have had these applied have been shown to be vulnerable again later.

If possible, use NTFS security to limit access.

If only 8.3 file and directory naming is used in the web space, this vulnerability will not occur.

Alternatively, for NTFS filesystems, you can disable 8.3 filenames entirely. Quoted from a Bugtraq post by David LeBlanc:

If you open the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem
and create a value named NtfsDisable8dot3NameCreation, type REG_DWORD, and set it to 1, then the operating system will not create 8.3 filenames (I think you'd have to reboot for it to take effect). Note that this isn't retroactive, so you'd need to move any trees you want updated, and then move them back. This is something that should be on anyone's checklist when setting up a web or FTP server prior to putting content on that server.

BTW, setting this value also gets you a modest improvement in file system performance. It will also break 16-bit apps, but hopefully you're not running any antique applications on your server. As always, test this sort of change thoroughly before putting it into production.

Microsoft IIS And PWS 8.3 Directory Name Vulnerability

References: