-----BEGIN PGP SIGNED MESSAGE-----

Microsoft Security Bulletin (MS00-019)
- --------------------------------------

Patch Available for "Virtualized UNC Share" Vulnerability
Originally Posted: March 30, 2000

Summary
- -------
Microsoft has released a patch that eliminates a security
vulnerability in Microsoft(r) Internet Information Server and
products based on it. Under certain fairly unusual conditions, the
vulnerability could cause a web server to send the source  code of
.ASP and other files to a visiting user.

Frequently asked questions regarding this vulnerability and the patch
can be found at
http://www.microsoft.com/technet/security/bulletin/fq00-019.asp

Issue
- -----
If a virtual directory on an IIS server is mapped to a UNC share, and
a request for a file in the directory contains one of  several
particular characters at the end, the expected ISAPI extension
processing may not occur. The result is that the  source code of the
file would be sent to the browser.

There are significant restrictions that would increase the difficulty
of exploiting this vulnerability:
 - By design, virtual directories hide the actual location of files.
   Under most circumstances, there would be no way for an attacker to
   determine which files on a server actually reside on a UNC share.
 - Many browsers will "correct" requests that contain the trailing
   characters at issue here, by either removing the characters or
   changing them.
 - If recommended security practices are followed, .ASP and other
   files that require server-side processing will not contain any
   sensitive information to compromise.

Affected Software Versions
==========================
 - Microsoft Internet Information Server 4.0 and 5.0
 - Microsoft Proxy Server 2.0
 - Microsoft Site Server and Site Server, Commerce Edition 3.0
 - Microsoft Commercial Internet System 2.0 and 2.5

Patch Availability
==================
 - Internet Information Server 4.0
   Intel:
   http://www.microsoft.com/downloads/release.asp?ReleaseID=18900
   Alpha:
   http://www.microsoft.com/downloads/release.asp?ReleaseID=18901
 - Internet Information Server 5.0
   http://www.microsoft.com/downloads/release.asp?ReleaseID=19982

NOTE: Proxy Server, Site Server, Site Server Commerce Edition and
Microsoft Commercial Internet System run atop IIS.  Customers using
these products should apply the patch appropriate for the version of
IIS they are running.

NOTE: Additional security patches are available at the Microsoft
Download Center.

More Information
================
Please see the following references for more information related to
this issue.
 - Frequently Asked Questions: Microsoft Security Bulletin MS00-019,
   http://www.microsoft.com/technet/security/bulletin/fq00-019.asp.
 - Microsoft Knowledge Base (KB) article Q249599,
   Virtual Directory Mapped to UNC Returns Server-Side Script Code
   When URL Contains Additional Characters at the End of the Request,
   http://www.microsoft.com/technet/support/kb.asp?ID=249599.
 - Microsoft TechNet Security web site,
   http://www.microsoft.com/technet/security/default.asp.

Obtaining Support on this Issue
===============================
This is a fully supported patch. Information on contacting Microsoft
Technical Support is available at
http://support.microsoft.com/support/contact/default.asp.

Revisions
=========
 - March 30, 2000: Bulletin Created.

- --------------------------------------------------------
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT  DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR  PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES
WHATSOEVER INCLUDING DIRECT,  INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT
CORPORATION OR ITS  SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF
LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING
LIMITATION MAY NOT APPLY.

Last updated March 30, 2000
(c) 2000 Microsoft Corporation. All rights reserved. Terms of use.

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.0.2

iQEVAwUBOOOgXo0ZSRQxA/UrAQEKjAf9GVsx2758Za9+fAyEYFmoQ0xaSHK0QAXh
7PCWw5L4bYwjZsVeFrLLn0oNRq2bqE+Fl+8vEU3K2Iu5Lj+Uco23Of500PQQdNLv
lRFPXaRLr9vIOYfE1H8qeDuvsOSxP0uTEXesOgLpmTnN0laq8ujqmohW5Oaz+Hzk
UIcuePCQU5Ff5TwOOqGpNfgSgRnX+U6+G/r1GjcJDCImbEIr6sCsU4j04Hs4NC0G
tUDYhcjPfCHfsOXKE81kbNF/dOcBu6fh9fQlgtaBfxm0MLI9hVkJRRgajXeR0Vsh
oB3fQ1HkED/2kyEbQTQbAUeF2c6xodLYTaQPN7PM0mnrLNhoDc3n5Q==
=qKLR
-----END PGP SIGNATURE-----

   *******************************************************************
You have received  this e-mail bulletin as a result  of your registration
to  the   Microsoft  Product  Security  Notification   Service.  You  may
unsubscribe from this e-mail notification  service at any time by sending
an  e-mail  to  MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
The subject line and message body are not used in processing the request,
and can be anything you like.

To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.

For  more  information on  the  Microsoft  Security Notification  Service
please  visit  http://www.microsoft.com/technet/security/notify.asp.  For
security-related information  about Microsoft products, please  visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.