Microsoft IIS 4.0 Domain Resolution Vulnerability

Bugtraq ID:	657
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 23 1999 12:00AM
Updated:	Sep 23 1999 12:00AM
Credit:	This was first publicized in Microsoft Security Bulletin MS99-039, released September 23, 1999.
Vulnerable:	Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft Commercial Internet System 2.5
Not Vulnerable:

Microsoft IIS 4.0 Domain Resolution Vulnerability

IIS 4.0 and CIS 2.5 allow an administrator the option to restrict access by specifying a domain or an IP address If a domain is restricted, but a machine in that domain that cannot be resolved makes an HTTP request, the IIS server will respond as usual. Any subsequent requests will be denied.

Restricted hosts with an IP address that can be resolved to a domain name will be denied access from the first request.

Microsoft IIS 4.0 Domain Resolution Vulnerability

See discussion

Microsoft IIS 4.0 Domain Resolution Vulnerability

Solution:
Microsoft has released a hotfix, available at:
IIS 4.0:
ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/IIS40/hotfixes-postSP6/security/IPRFTP-fix/
MCIS 2.5:
ftp://ftp.microsoft.com/bussys/mcis/mcis-public/fixes/usa/mcis25/security/ftpsvc-fix/

Microsoft IIS 4.0 Domain Resolution Vulnerability

References:

• Microsoft Security Bulletin (MS99-039): Frequently Asked Questions (Microsoft)
  
• Q241562: Denying Access With Domain Name Restriction Still Allows Unresolved Cli (Microsoft)