Microsoft IIS Administrative Pages Cross Site Scripting Vulnerabilities

Bugtraq ID:	6072
Class:	Input Validation Error
CVE:	CVE-2002-1181
Remote:	Yes
Local:	No
Published:	Oct 31 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	This vulnerability was first described in a Microsoft Security Bulletin.
Vulnerable:	Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS Administrative Pages Cross Site Scripting Vulnerabilities

Microsoft IIS is prone to cross site scripting attacks. The vulnerability is a result of improper sanitization of user-supplied input by IIS. Several web pages, provided by IIS for administrative purposes do not adequately sanitize user-supplied input. Any malicious HTML code that may be included in the URI will be executed.

This vulnerability could allow an attacker to execute script code in the 'Intranet' security zone.

This vulnerability was originally described in BugTraq ID 6068. It is now being assigned its own BugTraq ID.

Microsoft IIS Administrative Pages Cross Site Scripting Vulnerabilities

There is no exploit code required.

Microsoft IIS Administrative Pages Cross Site Scripting Vulnerabilities

Solution:
The following patches are available:


Microsoft IIS 5.1

• Microsoft Q327696: Internet Information Services Security Roll-up Package
  For 64-bit versions of Windows XP.
  http://download.microsoft.com/download/whistler/Patch/Q327696/W64XP/EN -US/Q327696_WXP_SP2_ia64_ENU.exe


• Microsoft Q327696: Internet Information Services Security Roll-up Package
  For 32-bit versions of Windows XP.
  http://download.microsoft.com/download/whistler/Patch/Q327696/WXP/EN-U S/Q327696_WXP_SP2_x86_ENU.exe

Microsoft IIS 4.0

• Microsoft Q327696: Internet Information Services Security Roll-up Package
  http://www.microsoft.com/ntserver/nts/downloads/security/q327696/defau lt.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43566%26re direct%3Dno

Microsoft IIS 5.0

• Microsoft Q327696: Internet Information Services Security Roll-up Package
  http://www.microsoft.com/windows2000/downloads/security/q327696/defaul t.asp?FinishURL=%2Fdownloads%2Frelease%2Easp%3FReleaseID%3D43296%26red irect%3Dno

Microsoft IIS Administrative Pages Cross Site Scripting Vulnerabilities

References:

• Microsoft Security Bulletin MS02-062 (Microsoft)
  
• [SNS Advisory No.58] Microsoft IIS Local Cross-site Scripting Vulnerability ("[email protected]" )