Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:22
HistoryMar 30, 2000 - 12:00 a.m.

Security Bulletin (MS00-019)

2000-03-3000:00:00
vulners.com
588

The following is a Security Bulletin from the Microsoft Product Security
Notification Service.

Please do not reply to this message, as it was sent from an unattended
mailbox.
********************************

-----BEGIN PGP SIGNED MESSAGE-----

Microsoft Security Bulletin (MS00-019)


Patch Available for "Virtualized UNC Share" Vulnerability
Originally Posted: March 30, 2000

Summary


Microsoft has released a patch that eliminates a security
vulnerability in Microsoft(r) Internet Information Server and
products based on it. Under certain fairly unusual conditions, the
vulnerability could cause a web server to send the source code of
.ASP and other files to a visiting user.

Frequently asked questions regarding this vulnerability and the patch
can be found at
http://www.microsoft.com/technet/security/bulletin/fq00-019.asp

Issue


If a virtual directory on an IIS server is mapped to a UNC share, and
a request for a file in the directory contains one of several
particular characters at the end, the expected ISAPI extension
processing may not occur. The result is that the source code of the
file would be sent to the browser.

There are significant restrictions that would increase the difficulty
of exploiting this vulnerability:

  • By design, virtual directories hide the actual location of files.
    Under most circumstances, there would be no way for an attacker to
    determine which files on a server actually reside on a UNC share.
  • Many browsers will "correct" requests that contain the trailing
    characters at issue here, by either removing the characters or
    changing them.
  • If recommended security practices are followed, .ASP and other
    files that require server-side processing will not contain any
    sensitive information to compromise.

Affected Software Versions

  • Microsoft Internet Information Server 4.0 and 5.0
  • Microsoft Proxy Server 2.0
  • Microsoft Site Server and Site Server, Commerce Edition 3.0
  • Microsoft Commercial Internet System 2.0 and 2.5

Patch Availability

NOTE: Proxy Server, Site Server, Site Server Commerce Edition and
Microsoft Commercial Internet System run atop IIS. Customers using
these products should apply the patch appropriate for the version of
IIS they are running.

NOTE: Additional security patches are available at the Microsoft
Download Center.

More Information

Please see the following references for more information related to
this issue.

Obtaining Support on this Issue

This is a fully supported patch. Information on contacting Microsoft
Technical Support is available at
http://support.microsoft.com/support/contact/default.asp.

Revisions

  • March 30, 2000: Bulletin Created.