Microsoft IIS Redirection Error Page Cross-Site Scripting Vulnerability

Bugtraq ID:	7731
Class:	Input Validation Error
CVE:	CVE-2003-0223
Remote:	Yes
Local:	No
Published:	May 28 2003 12:00AM
Updated:	Jul 11 2009 10:06PM
Credit:	Discovery is credited to SPIDynamics SPI Labs.
Vulnerable:	Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:	Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition

Microsoft IIS Redirection Error Page Cross-Site Scripting Vulnerability

Microsoft IIS is prone to a cross-site scripting vulnerability in the redirection error page. An attacker could exploit this issue by enticing a web user to a malicious link which contains hostile HTML or script code. This code may be rendered in the user's browser when the redirection error page is displayed.

Microsoft IIS Redirection Error Page Cross-Site Scripting Vulnerability

Solution:
Microsoft has released updates.

There is a dependency associated with this patch. It requires the patch from Microsoft Security Bulletin MS02-050 to be installed. If this patch is installed and MS02-050 is not present, client side certificates will be rejected. This functionality can be restored by installing the MS02-050 patch.


Microsoft IIS 5.1

• Microsoft Q811114
  For Windows XP 32-bit edition. IIS 5.1 patch to be installed on systems running Windows XP Professional Gold and Service Pack 1.
  http://microsoft.com/downloads/details.aspx?FamilyId=77CFE3EF-C5C5-401 C-BC12-9F08154A5007&displaylang=en


• Microsoft Q811114
  For Windows XP 64-bit edition. IIS 5.1 patch to be installed on systems running Windows XP Professional Gold and Service Pack 1.
  http://microsoft.com/downloads/details.aspx?FamilyId=86F4407E-B9BF-449 0-9421-008407578D11&displaylang=en

Microsoft IIS 4.0

• Microsoft Q811114
  IIS 4.0 patch to be installed on systems running Windows NT 4.0 Service Pack 6a.
  http://microsoft.com/downloads/details.aspx?FamilyId=1DBC1914-98E9-4DE D-ADBF-E9B374A1F79D&displaylang=en

Microsoft IIS 5.0

• Microsoft Q811114
  IIS 5.0 patch to be installed on systems running Windows 2000 Service Pack 2 or Service Pack 3.
  http://microsoft.com/downloads/details.aspx?FamilyId=2F5D9852-4ADD-44F 8-8715-AC3D7D7D94BF&displaylang=en

Microsoft IIS Redirection Error Page Cross-Site Scripting Vulnerability

References:

• Microsoft Security Bulletin MS02-050 (Microsoft)
  
• Microsoft Security Bulletin MS03-018 (Microsoft)