Microsoft IIS FTP NO ACCESS Read/Delete File Vulnerability

Bugtraq ID:	658
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Sep 23 1999 12:00AM
Updated:	Sep 23 1999 12:00AM
Credit:	This information was first made public in an advisory from Microsoft <MS99-039>. Microsoft credits Roberto Franceschetti for discovering this vulnerability.
Vulnerable:	Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft Commercial Internet System 2.5
Not Vulnerable:

Microsoft IIS FTP NO ACCESS Read/Delete File Vulnerability

IIS 4.0 FTP servers which have installed a specific post SP5 FTP hotfix are vulnerable to an exploit whereby FTP clients may download. and/or delete files (on the FTP server) that have been specifically marked as 'No Access' (via NTFS file or directory permissions). Web browser FTP clients may be able to view and/or download these files, while specially crafted requests from non-browser based FTP clients may be able to delete these files.

This vulnerability only affects IIS 4.0 servers running NT 4.0 SP5 with a specific post SP5 hotfix for an FTP get error as described in <http://support.microsoft.com/support/kb/articles/Q237/9/87.ASP >. Microsoft states there are no negative ramifications to applying this hotfix to SP4 or SP5 hosts who have not installed the previously referenced FTP hotfix.

To see if you are vulnerable, check the file version for Ftpsvc.dll. Versions 0718 through 0722 are thought to be vulnerable, although Microsoft documentation is unclear as to whether the vulnerable versions start with 0718 or 0719. Version 0724 represents the version installed by the latest hotfix.

The hotfix designed to correct this problem was not released in time for the upcoming NT 4.0 Service Pack 6. Service Pack 6 contains the "buggy" hotfix and will be vulnerable to this error when it is released. It will be necessary to install the corresponding hotfix after installing Service Pack 6, regardless of whether or not the Service Pack 5 installation was vulnerable.

Microsoft IIS FTP NO ACCESS Read/Delete File Vulnerability

see discussion

Microsoft IIS FTP NO ACCESS Read/Delete File Vulnerability

Solution:
Microsoft has released a hotfix for this vulnerability. This hotfix was too late to be included in NT 4.0 SP6 (as yet unreleased), so it has been released as an IIS Post -SP6 hotfix for IIS and a fix for CIS. The patches can be found at
IIS 4.0:
ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/IIS40/hotfixes-postSP6/security/IPRFTP-fix/
MCIS 2.5:
ftp://ftp.microsoft.com/bussys/mcis/mcis-public/fixes/usa/mcis25/security/ftpsvc-fix/

Microsoft states there are no negative ramifications to applying this hotfix to SP4 or SP5 hosts who have not installed the previously referenced FTP hotfix.

The hotfix designed to correct this problem was not released in time for the upcoming NT 4.0 Service Pack 6. Service Pack 6 contains the "buggy" hotfix and will be vulnerable to this error when it is released. It will be necessary to install this hotfix after installing Service Pack 6, regardless of whether or not the Service Pack 5 installation was vulnerable.

Microsoft IIS FTP NO ACCESS Read/Delete File Vulnerability

References:

• Combined FTP and Domain Restriction Security Patch for IIS 4.0 (Microsoft)
  
• Files on an FTP Server Can Be Improperly Accessed (Microsoft)
  
• Frequently Asked Questions: Microsoft Security Bulletin (MS99-039) (Microsoft)
  
• FTP GET Does Not Work Correctly on UNC Virtual Directories (Microsoft)