Microsoft IIS WebDAV Denial Of Service Vulnerability

Bugtraq ID:	6070
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-1182
Remote:	Yes
Local:	No
Published:	Oct 31 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	Discovery of this vulnerability credited to Mark Litchfield of Next Generation Security Software Ltd. (http://www.nextgenss.com).
Vulnerable:	Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server
Not Vulnerable:

Microsoft IIS WebDAV Denial Of Service Vulnerability

Solution:
Patches are available:


Microsoft IIS 5.1

• Microsoft Q327696: Internet Information Services Security Roll-up Package
  For 64-bit versions of Windows XP.
  http://download.microsoft.com/download/whistler/Patch/Q327696/W64XP/EN -US/Q327696_WXP_SP2_ia64_ENU.exe


• Microsoft Q327696: Internet Information Services Security Roll-up Package
  For 32-bit versions of Windows XP.
  http://download.microsoft.com/download/whistler/Patch/Q327696/WXP/EN-U S/Q327696_WXP_SP2_x86_ENU.exe

Microsoft IIS 5.0

• Microsoft Q327696: Internet Information Services Security Roll-up Package
  http://www.microsoft.com/windows2000/downloads/security/q327696/defaul t.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43296%26red irect%3Dno

Microsoft IIS WebDAV Denial Of Service Vulnerability

References:

• Microsoft Security Bulletin MS02-062 (Microsoft)
  
• Microsoft Internet Information Server 5/5.1 Denial of Service (#NISR31102002) ("NGSSoftware Insight Security Research" )