what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

NSSA-200305.txt

NSSA-200305.txt
Posted May 31, 2003
Authored by NSFOCUS | Site nsfocus.com

A buffer overflow vulnerability exists in the way a dynamic linking library (ssinc.dll)that is shipped with Microsoft IIS 4.0/5.0 handles the files it contains. Exploiting the vulnerability, local attackers could gain local system privileges.

tags | advisory, overflow, local
SHA-256 | 80719fd500d2b9d91176bd0bb701df5bd2e4fa86a32fd7e6ccc2f7e5f15285f1

NSSA-200305.txt

Change Mirror Download
ines: 136

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

NSFOCUS Security Advisory(SA2003-05)

Topic: Microsoft IIS ssinc.dll Over-long Filename Buffer Overflow Vulnerability

Release Date: 2003-5-30

CVE CAN ID: CAN-2003-0224

Affected system:
===================

- - Microsoft IIS 5.0

Unaffected system:
======================
- - Microsoft IIS 4.0
- - Microsoft IIS 5.1

Summary:
=========

NSFOCUS Security Team has found a buffer overflow vulnerability in the way
a dynamic linking library (ssinc.dll)that is shipped with Microsoft IIS 4.0/5.0
handles the files it contains. Exploiting the vulnerability local attackers
could gain local system privilege.

Description:
============

Microsoft IIS supports SSI(Server Side Include) functionality. ssinc.dll is
a SSI interpreter. By default extended name .stm,.shtm and .shtml will be
mapped to interpreter(ssinc.dll).

SSI supports "#include" command. Typically it is used as the following:

<!--#include file="filename"-->

When handling "#include" command ssinc.dll will first attempt to gain the
physical path of the shtml file, so it will copy the URI request to a buffer
the size of which is fixed. For example, when requesting the following
shtml file:
http://iishost/abc/test.shtml

It will copy "/abc/test.shtml" to a buffer the size of which is fixed. Because
the length of the shtml filename has not been checked during the copying,
it causes a stack buffer overflow.

NSFocus Security Team has found a similar problem. See
http://www.nsfocus.net/index.php?act=advisory&do=view&adv_id=17
The corresponding Microsoft Security Bulletin is:
http://www.microsoft.com/technet/security/bulletin/ms01-044.asp

This vulnerability occurred before that one.

IIS has checked the over-long shtml filename to avoid buffer overflow,
while its method is to shorten the filename to legal length, then attempt
to open it. After that ssinc.dll will still use the original URI to finish
the copy. Therefore, by creating a WEB file with special length local attackers
could bypass the check, then request a shtml file with an over-long filename
to cause a buffer overflow, which would cause IIS cease to respond. By carefully
crafting the overflow data attackers could run arbitrary code with Local System
privilege.

Two conditions are required to carry out the attack:

1. Attackers need to have the privilege to create files on web directory.
2. Attackers need to be able to access the created files via web service.

Workaround:
=============

1. Disable untrusted users' writing privilege to web directory.
2. If SSI functionality is not required, remove .shtml, .shtm, .stm mapping.
3. Install IIS Lockdown tools provided by Microsoft:
http://www.microsoft.com/downloads/details.aspx?familyid=dde9efc0-bb30-
47eb-9a61-fd755d23cdec&displaylang=en

Vendor Status:
==============

2002.11.05 Inform vendor about the issue
2003.05.28 Microsoft has issued a Security Bulletin(MS03-018) and the related patch.

Detailed Microsoft Security Bulletin is available at:

http://www.microsoft.com/technet/security/bulletin/ms03-018.asp

Patches are available at:

http://microsoft.com/downloads/details.aspx?FamilyId=2F5D9852-4ADD-44F8-8715-AC3D7D7D94BF

Additional Information:
========================

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2003-0224 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security
problems. Candidates may change significantly before they become official
CVE entries.

Credit:
=========

This vulnerability was discovered by Ren Guang Yuan of NSFOCUS Security Team.

DISCLAIMS:
==========
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED,
EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
ADVISORY IS NOT MODIFIED IN ANY WAY.

Copyright 1999-2003 NSFOCUS. All Rights Reserved. Terms of use.


NSFOCUS Security Team <security@nsfocus.com>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
(http://www.nsfocus.com)

PGP Key: http://www.nsfocus.com/homepage/research/pgpkey.asc
Key fingerprint = F8F2 F5D1 EF74 E08C 02FE 1B90 D7BF 7877 C6A6 F6DA
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+12Qt1794d8am9toRAmOLAJ4nmkk6m5yq4mhn0AzyiuGm5lOt2QCbBaKj
WQLml8XHG18hB0IEG4gq+Pc=
=QUiN
-----END PGP SIGNA
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close