Microsoft IIS Malformed HTTP Get Request Denial Of Service Vulnerability

Bugtraq ID:	6789
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Dec 17 1998 12:00AM
Updated:	Dec 17 1998 12:00AM
Credit:	This issue was announced in a Microsoft Security Bulletin.
Vulnerable:	Microsoft IIS 4.0 alpha - Microsoft Windows NT 4.0 alpha - Microsoft Windows NT 4.0 alpha Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft IIS 3.0 alpha Microsoft IIS 3.0 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft IIS Malformed HTTP Get Request Denial Of Service Vulnerability

It is possible to trigger a denial of service condition in Microsoft IIS (Internet Information Services) 3.0/4.0 when a specially malformed HTTP GET request is handled by the server. This will cause the server process to hang, consuming resources, which may possibly result in system instability.

Microsoft IIS Malformed HTTP Get Request Denial Of Service Vulnerability

There is no exploit required.

Microsoft IIS Malformed HTTP Get Request Denial Of Service Vulnerability

Solution:
Microsoft has released patches which address this issue. The vulnerability was also addressed in Microsoft Windows NT 4.0 SP5.


Microsoft IIS 3.0 alpha

• Microsoft Q192296
  Fixes IIS 3.0 on Alpha platforms.
  ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfi xes-postSP4/archive/Infget-fix/infget3a.exe

Microsoft IIS 3.0

• Microsoft Q192296
  Fixes IIS 3.0 on x86 platforms.
  ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfi xes-postSP4/archive/Infget-fix/infget3i.exe

Microsoft IIS 4.0 alpha

• Microsoft Q192296
  Fixes IIS 4.0 on Alpha platforms.
  ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/Infge t-fix/infget4a.exe

Microsoft IIS 4.0

• Microsoft Q192296
  Fixes IIS 4.0 on x86 platforms.
  ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/Infge t-fix/infget4i.exe

Microsoft IIS Malformed HTTP Get Request Denial Of Service Vulnerability

References:

• Microsoft Security Bulletin MS98-019 (Microsoft)