Microsoft Internet Information Service Multiple Vulnerabilities

Bugtraq ID:	7728
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 28 2003 12:00AM
Updated:	May 28 2003 12:00AM
Credit:	Discovery of these vulnerabilities credited to SPIDynamics SPI Labs and NSFocus.
Vulnerable:	Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:	Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition

Microsoft Internet Information Service Multiple Vulnerabilities

Solution:
The following patches are available:


Microsoft IIS 5.1

• Microsoft Q811114
  For Windows XP 32-bit edition. IIS 5.1 patch to be installed on systems running Windows XP Professional Gold and Service Pack 1.
  http://microsoft.com/downloads/details.aspx?FamilyId=77CFE3EF-C5C5-401 C-BC12-9F08154A5007&displaylang=en


• Microsoft Q811114
  For Windows XP 64-bit edition. IIS 5.1 patch to be installed on systems running Windows XP Professional Gold and Service Pack 1.
  http://microsoft.com/downloads/details.aspx?FamilyId=86F4407E-B9BF-449 0-9421-008407578D11&displaylang=en

Microsoft IIS 4.0

• Microsoft Q811114
  IIS 4.0 patch to be installed on systems running Windows NT 4.0 Service Pack 6a.
  http://microsoft.com/downloads/details.aspx?FamilyId=1DBC1914-98E9-4DE D-ADBF-E9B374A1F79D&displaylang=en

Microsoft IIS 5.0

• Microsoft Q811114
  IIS 5.0 patch to be installed on systems running Windows 2000 Service Pack 2 or Service Pack 3.
  http://microsoft.com/downloads/details.aspx?FamilyId=2F5D9852-4ADD-44F 8-8715-AC3D7D7D94BF&displaylang=en

Microsoft Internet Information Service Multiple Vulnerabilities

References:

• Microsoft Security Bulletin MS03-018 (Microsoft)
  
• Internet Information Services 5.0 Denial of service ("SPI Labs" )