Microsoft IIS HTR ISAPI ISM.DLL extension buffer overflow
| iis-htr-isapi-bo (8799) |  High Risk |
Description:
Microsoft Internet Information Server (IIS) is vulnerable to a buffer overflow in the ISAPI (Internet Services Application Programming Interface) ISM.DLL extension, which is used to implement HTR scripting. By sending a series of malformed HTR script requests to the Web server, a remote attacker could overflow a buffer and execute arbitrary code on the system with elevated privileges or cause the IIS service to fail.The ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided. This may allow remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.
Platforms Affected:
- Microsoft, IIS 4.0
- Microsoft, IIS 5.0
Remedy:
Enable the following checks in the ISS Protection Platform:
HTTP_IIS_htr_isapi
Block or restrict the following in the ISS Protection Platform as appropriate to the environment:
Port 80
For Manual Protection:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS02-062. See References.
Note: Microsoft originally provided a patch for this vulnerability in MS02-018, but it was superseded by the patch released with MS02-062, and then superseded by the patch released with MS03-018. See References.
Note: This vulnerability also affects several Cisco products that use IIS. For affected products and upgrade or patch information refer to Cisco Security Advisory: Microsoft IIS Vulnerabilities in Cisco Products - MS02-018. See References.
Consequences:
Gain Access
References:
- @stake, Inc. Security Advisory A041002-1, .htr heap overflow in IIS 4.0 and 5.0 at http://www.webproxy.com/research/advisories/2002/a041002-1.txt.
- CERT Advisory CA-2002-09, Multiple Vulnerabilities in Microsoft IIS at http://www.cert.org/advisories/CA-2002-09.html.
- CIAC Information Bulletin M-066, Microsoft Cumulative Patch for Internet Information Services (IIS) Vulnerabilities at http://www.ciac.org/ciac/bulletins/m-066.shtml.
- Cisco Systems Inc. Security Advisory, 2002 April 15 18:00 (UTC -0400), Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 at http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml.
- Internet Security Systems Security Alert #114, Multiple Remote Vulnerabilities in Microsoft IIS at http://www.iss.net/xforce/alerts/id/advise114.
- Microsoft Knowledge Base Article 318091, MS02-018: Patch Available for Buffer Overrun in HTR ISAPI Extension Vulnerability at http://support.microsoft.com/default.aspx?scid=kb;[LN];318091.
- Microsoft Knowledge Base Article 319733, MS02-018: April 2002 Cumulative Patch for Internet Information Services at http://support.microsoft.com/default.aspx?scid=kb;[LN];319733.
- Microsoft Security Bulletin MS02-018, Cumulative Patch for Internet Information Services (Q319733) at http://www.microsoft.com/technet/security/bulletin/ms02-018.mspx.
- Microsoft Security Bulletin MS02-062, Cumulative Patch for Internet Information Service (Q327696) at http://www.microsoft.com/technet/security/Bulletin/MS02-062.mspx.
- Microsoft Security Bulletin MS03-018, Cumulative Patch for Internet Information Service (811114) at http://www.microsoft.com/technet/security/bulletin/ms03-018.mspx.
- National Infrastructure Protection Center Advisory 02-002, Multiple Remote Vulnerabilities in Microsoft's Internet Information Services (IIS) at http://www.nipc.gov/warnings/advisories/2002/02-002.htm.
- VulnWatch Mailing List, Thu Apr 11 2002 - 05:12:52 CDT, KPMG-2002010: Microsoft IIS .htr ISAPI buffer overrun at http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0013.html. (From Neohapsis archive)
- BID-4474: Microsoft IIS HTR ISAPI Extension Buffer Overflow Vulnerability
- CVE-2002-0071: Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.
- OSVDB ID: 3325: Microsoft IIS HTR ISAPI Overflow
- US-CERT VU#363715: Microsoft Internet Information Server (IIS) vulnerable to heap overflow during processing of crafted .htr request by ISM.DLL ISAPI filter
Reported:
Apr 10, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net