hallo,
beim treffen wollten ja einige die beschreibung für das sicherheitsloch im iis4 und iis5 haben. ich bin im BugTraq-Archive (z.b. http://www.securityfocus.com/) fündig geworden. hier die entscheidenden punkte.
cu ronny
------------------
Affected system: ================
- Microsoft IIS 4.0 (<SP6) - Microsoft IIS 5.0
Not affected system: ====================
- Microsoft IIS 4.0 ( SP6/SP6a )
Impact: =========
NSFOCUS security team has found a security flaw in Microsoft IIS 4.0/ 5.0 when handling a CGI file name. Exploitation of it, attacker can read system file and run arbitrary system command.
Description ===========
In CGI application (.exe, .pl, .php etc.) handling, Microsoft IIS 4.0/ 5.0 do not present an integrated security inspection of CGI file name, which may cause IIS to mistakenly open or run a file if a special character is contained in the file name.
1. Providing a malformed HTTP request that calls IIS to run a ".exe" or ".com" program under executable directory, IIS will try to load the program and check file existence and file type first. Attacker can trap the loading program to check a non-requested file by inserting a special character in the file name.
If fulfilling these terms:
(1) Target file exists (2) Target file is a batch file (3) Target file is a plain text file longer than zero byte
IIS will automatically call "cmd.exe" to interpret it. Other part of file name requested is pass to "cmd.exe" as parameters of the batch file. Thus, an attacker can run arbitrary command by inserting some characters like "&".
2. If some script interpreter(php.exe, perl.exe etc.) and relevant mapping are installed, IIS will call them to interpret the file name submitted by user to run the corresponding CGI script. Inserting some special characters, attacker can trap the interpreter to open some file outside of WEB directory. Depending on the execution method of the interpreter, attacker may read part or even the full file content.
lug-dd@mailman.schlittermann.de