Microsoft IIS Virtual Directory Naming Vulnerability

Bugtraq ID:	882
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	Yes
Published:	Dec 21 1999 12:00AM
Updated:	Dec 21 1999 12:00AM
Credit:	Reported to Microsoft by Adam Hunger and published in a Microsoft Security Advisory released December 21, 1999.
Vulnerable:	Microsoft Site Server Commerce Edition 3.0 i386 + Hancom Hancom Office 2007 0 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 + Microsoft Commercial Internet System 2.0 + Microsoft Site Server Commerce Edition 3.0 alpha - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 Microsoft Site Server Commerce Edition 3.0 alpha - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft IIS 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

Microsoft IIS Virtual Directory Naming Vulnerability

Server side processing of web pages can be bypassed under a specific set of conditions. If an .asp or similar file resides in a virtual directory whose name ends in a legal extension, the source code of the file may be sent to the client browser.

IIS determines what action to take on a web document by parsing the URL for the filename extension. The first registered extension found in the string is used to make this decision. Therefore, if a request is made for the following file: /webroot/docs.htm/some.asp, and that file exists, IIS will parse the path and find the .htm extension in the virtual directory name docs.htm, determine that no preprocessing is required, and send the unprocessed source of the some.asp file.

Microsoft IIS Virtual Directory Naming Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft IIS Virtual Directory Naming Vulnerability

Solution:
Microsoft has released a patch for this issue, available at:
Intel:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=16378
alpha:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=16379

The patch changes how IIS parses the URL. After applying the patch, IIS will return an error anytime a file in a virtual directory with a legal extension is requested.

Microsoft IIS Virtual Directory Naming Vulnerability

References:

• Microsoft Security Bulletin MS99-058: Frequently Asked Questions (Microsoft)
  
• Q186803: Browsing Folders with Script-Mapped Extensions Returns Errors (Microsoft)
  
• Q238606: Page Contents Visible When Certain Dot Extensions Present in the Virtua (Microsoft)