NT Index Server Directory Traversal Vulnerability
BID:950
Info
NT Index Server Directory Traversal Vulnerability
| Bugtraq ID: | 950 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jan 26 2000 12:00AM |
| Updated: | Jan 26 2000 12:00AM |
| Credit: | Discovered by David Litchfield, publicized in CIS Advisory CISADV000126 and Microsoft Security Bulletin MS00-006, both released January 26, 2000. |
| Vulnerable: |
Microsoft Indexing Services for Windows 2000 Microsoft Index Server 2.0 |
| Not Vulnerable: | |
Discussion
NT Index Server Directory Traversal Vulnerability
Index Server 2.0 is a utility included in the NT 4.0 Option Pack. The functionality provided by Index Service has been built into Windows 2000 as Indexing Services.
When combined with IIS, Index Server and Indexing Services include the ability to view web search results in their original context. It will generate an html page showing the query terms in a short excerpt of the surrounding text for each page returned, along with a link to that page. This is known as "Hit Highlighting". To do this, it supports the .htw filetype which is handled by the webhits.dll ISAPI application. This dll will allow the use of the '../' directory traversal string in the selection of a template file. This will allow for remote, unauthenticated viewing of any file on the system whose location is known by the attacker.
The original patch released for this issue still discloses 'include' file types. 'include' files contain various data which assist in the execution of program files.
Index Server 2.0 is a utility included in the NT 4.0 Option Pack. The functionality provided by Index Service has been built into Windows 2000 as Indexing Services.
When combined with IIS, Index Server and Indexing Services include the ability to view web search results in their original context. It will generate an html page showing the query terms in a short excerpt of the surrounding text for each page returned, along with a link to that page. This is known as "Hit Highlighting". To do this, it supports the .htw filetype which is handled by the webhits.dll ISAPI application. This dll will allow the use of the '../' directory traversal string in the selection of a template file. This will allow for remote, unauthenticated viewing of any file on the system whose location is known by the attacker.
The original patch released for this issue still discloses 'include' file types. 'include' files contain various data which assist in the execution of program files.
Exploit / POC
Solution / Fix
NT Index Server Directory Traversal Vulnerability
Solution:
Microsoft has released patches for this issue, available at:
Index Server 2.0:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29631
Indexing Services for Windows 2000:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29561
Solution:
Microsoft has released patches for this issue, available at:
Index Server 2.0:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29631
Indexing Services for Windows 2000:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29561
References
NT Index Server Directory Traversal Vulnerability
References:
References: