Superfluous Decoding Operation Could Allow Command Execution via IIS New

A security vulnerability exists in IIS 5.0 and 4.0 which could enable a malicious user to run operating system commands on an affected Web server.

Issue

When IIS receives a user request to run a script or other server-side program, it performs a decoding pass to render the request in a canonical form, then performs security checks on the decoded request. A vulnerability results because a second, superfluous decoding pass is performed after the security checks are completed. If an attacker submitted a specially constructed request, it could be possible for the request to pass the security checks, but then be mapped via the second decoding pass into one that should have been blocked -- specifically, it could enable the request to execute operating system commands or programs outside the virtual folder structure. These would be executed in the security context of the IUSR_machinename account which, by virtue of its membership in the Everyone group, would grant the attacker capabilities similar to those of a non-administrative user interactively logged on at the console.

Affected Products

• Microsoft IIS 4.0 & 5.0

Download

Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29764

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: May 31, 2001

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<