__________________________________________________________

                       The U.S. Department of Energy
                     Computer Incident Advisory Center
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

             Unchecked Buffer in ISAPI Extension of IIS 5.0 Server

May 2, 2001 21:00 GMT                                             Number L-078
______________________________________________________________________________
PROBLEM:       The Microsoft IIS 5.0 web server running on Windows 2000 has a
               buffer overflow vulnerabilty which will give an attacker
               complete control of the server.
PLATFORM:      Microsoft IIS 5.0 running on Windows 2000
DAMAGE:        A remote attacker can conduct a buffer overrun attack and cause
               code of their choice to run on the server. Such code would run
               in the Local System security context giving the attacker
               complete control of the server, and would enable them to take
               virtually any action they chose.
SOLUTION:      Apply the patch as shown in Microsoft Security Bulletin
               MS01-023.
               http://www.microsoft.com/technet/security/bulletin/MS01-023.asp
______________________________________________________________________________
VULNERABILITY  The risk is HIGH, remote system level code execution
ASSESSMENT:
______________________________________________________________________________

   [***** Start Microsoft Security Bulletin *****]


Title:      Unchecked Buffer in ISAPI Extension Could Enable
            Compromise of IIS 5.0 Server
Date:       01 May 2001
Software:   Windows 2000 Server
            Windows 2000 Advanced Server
            Windows 2000 Datacenter Server
Impact:     Run code of attacker's choice, in Local System context
Bulletin:   MS01-023


Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-023.asp.
- ----------------------------------------------------------------------


Issue:
======
Windows 2000 introduced native support for the Internet Printing
Protocol (IPP), an industry-standard protocol for submitting and
controlling print jobs over HTTP. The protocol is implemented in
Windows 2000 via an ISAPI extension that is installed by default on
all
Windows 2000 servers but which can only be accessed via IIS 5.0.


A security vulnerability results because the ISAPI extension contains
an unchecked buffer in a section of code that handles input
parameters.
This could enable a remote attacker to conduct a buffer overrun
attack
and cause code of her choice to run on the server. Such code would
run
in the Local System security context. This would give the attacker
complete control of the server, and would enable her to take
virtually
any action she chose.


The attacker could exploit the vulnerability against any server with
which she could conduct a web session. No other services would need
to
be available, and only port 80 (HTTP) or 443 (HTTPS) would need to be
open. Clearly, this is a very serious vulnerability, and Microsoft
strongly recommends that all IIS 5.0 administrators install the patch
immediately. Alternatively, customers who cannot install the patch
can
protect their systems by removing the mapping for Internet Printing
ISAPI extension.


Mitigating Factors:
====================
 - Servers on which the mapping for the Internet Printing
   ISAPI extension has been removed are not at risk from
   this vulnerability. The process for removing the mapping
   is discussed in the IIS 5.0 Security Checklist
   (http://www.microsoft.com/technet/security/iis5chk.asp).
   The High Security template provided in the checklist
   (http://www.microsoft.com/technet/security/tools.asp)
   removes the mapping, as does the Windows 2000 Internet
   Security Tool unless the user explicitly chose to retain
   Internet Printing.
 - The attacker's ability to extend her control from a
   compromised web server to other machines would be heavily
   dependent on the specific configuration of the network.
   Best practices recommend that the network architecture reflect
   the position of special risk occupied by network-edge machines
   like web servers and use measures like DMZs and limited domain
   memberships to isolate such machines from the rest of the
   network. Taking such measures would impede an attacker's ability
   to broaden the scope of the compromise.


Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the
   Security Bulletin
   http://www.microsoft.com/technet/security/bulletin/ms01-023.asp
   for information on obtaining this patch.


Acknowledgment:
===============
 - eEye Digital Security (http://www.eeye.com)


- ---------------------------------------------------------------------


THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY
NOT APPLY.

   [***** End Microsoft Security Bulletin *****]   

_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Microsoft for the
information contained in this bulletin.
_______________________________________________________________________________

CIAC, the Computer Incident Advisory Center, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
                        (or http://ciac.llnl.gov -- they're the same machine)
   Anonymous FTP:       ftp.ciac.org
                        (or ciac.llnl.gov -- they're the same machine)

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

L-068: Cisco VPN3000 Concentrator TELNET Vulnerability
L-069: Cisco Content Services Switch User Account Vulnerability
L-070: FTP Filename Expansion Vulnerability
L-071: Various Vendors' Network Time Protocol (NTP) Vulnerability
L-072: Cisco Catalyst 5000 Series 802.1x Vulnerability
L-073: Microsoft ISA Web Proxy Service Denial of Service
L-074: Microsoft WebDAV Runs Scripts As User
L-075: FreeBSD IPFilter May Incorrectly Pass Packets
L-076: Red Hat Ptrace and Exec Race Conditions
l-077: The Glacier Backdoor