"Absent Directory Browser Argument" DoS

Advisory Code:   VIGILANTE-2000003

Release Date:
July 15, 2000

Systems Affected:
Internet Information Server 4.0 for NT (upgraded from IIS 3.0)
Internet Information Server 5.0 for NT (upgraded from IIS 3.0)

THE PROBLEM
A system with Internet Information Server 4.0 or 5.0 that was upgraded from
3.0, contains unused remains from 3.0 due to functionality changes in 4.0.
Since it's easy to "accidentally" install 3.0 when you install the server,
there is bound to be quite a few systems out there that haven't cleaned out
the no longer used scripts and thus are vulnerable.
Issuing a malformed request for a certain file contained in
/scripts/iisadmin can result in the webserver going into to an infinite
loop, causing the web server to no longer accept requests. The service will
continue to "pick up" on TCP port 80 (or where ever you installed it), but
will not honour HTTP requests. During testing of this, it was usually
necessary to reboot the machine in order for IIS to start working again,
simply attempting to stop and start inetinfo did not work.

Vendor Status:
Initially reported on the 24th of May this year. Microsoft has released the
following bulletin concerning the issue, including a patch:
http://www.microsoft.com/technet/security/bulletin/MS00-044.asp

Fix: 
Internet Information Server 4.0:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=22709
Internet Information Server 5.0:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=22708


Vendor   URL: http://www.microsoft.com
Internet Information Server 4.0 URL: 
http://www.microsoft.com/ntserver/web/default.asp
Internet Information Server 5.0 URL:
http://www.microsoft.com/windows2000/guide/server/features/appsvcs.asp

Copyright VIGILANTe 2000-07-15

Disclaimer:
The information within this document may change without notice. Use of
this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any consequences whatsoever
arising out of or in connection with the use or spread of this
information. Any use of this information lays within the user's
responsibility.

Feedback:
Please send suggestions, updates, and comments to:

VIGILANTe
mailto: info@vigilante.com
http://www.vigilante.com