Bugtraq mailing list archives
Microsoft Security Bulletin (MS00-019)
From: secnotif () MICROSOFT COM (Microsoft Product Security)
Date: Thu, 30 Mar 2000 10:43:49 -0800
The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. ******************************** -----BEGIN PGP SIGNED MESSAGE----- Microsoft Security Bulletin (MS00-019) - -------------------------------------- Patch Available for "Virtualized UNC Share" Vulnerability Originally Posted: March 30, 2000 Summary - ------- Microsoft has released a patch that eliminates a security vulnerability in Microsoft(r) Internet Information Server and products based on it. Under certain fairly unusual conditions, the vulnerability could cause a web server to send the source code of .ASP and other files to a visiting user. Frequently asked questions regarding this vulnerability and the patch can be found at http://www.microsoft.com/technet/security/bulletin/fq00-019.asp Issue - ----- If a virtual directory on an IIS server is mapped to a UNC share, and a request for a file in the directory contains one of several particular characters at the end, the expected ISAPI extension processing may not occur. The result is that the source code of the file would be sent to the browser. There are significant restrictions that would increase the difficulty of exploiting this vulnerability: - By design, virtual directories hide the actual location of files. Under most circumstances, there would be no way for an attacker to determine which files on a server actually reside on a UNC share. - Many browsers will "correct" requests that contain the trailing characters at issue here, by either removing the characters or changing them. - If recommended security practices are followed, .ASP and other files that require server-side processing will not contain any sensitive information to compromise. Affected Software Versions ========================== - Microsoft Internet Information Server 4.0 and 5.0 - Microsoft Proxy Server 2.0 - Microsoft Site Server and Site Server, Commerce Edition 3.0 - Microsoft Commercial Internet System 2.0 and 2.5 Patch Availability ================== - Internet Information Server 4.0 Intel: http://www.microsoft.com/downloads/release.asp?ReleaseID=18900 Alpha: http://www.microsoft.com/downloads/release.asp?ReleaseID=18901 - Internet Information Server 5.0 http://www.microsoft.com/downloads/release.asp?ReleaseID=19982 NOTE: Proxy Server, Site Server, Site Server Commerce Edition and Microsoft Commercial Internet System run atop IIS. Customers using these products should apply the patch appropriate for the version of IIS they are running. NOTE: Additional security patches are available at the Microsoft Download Center. More Information ================ Please see the following references for more information related to this issue. - Frequently Asked Questions: Microsoft Security Bulletin MS00-019, http://www.microsoft.com/technet/security/bulletin/fq00-019.asp. - Microsoft Knowledge Base (KB) article Q249599, Virtual Directory Mapped to UNC Returns Server-Side Script Code When URL Contains Additional Characters at the End of the Request, http://www.microsoft.com/technet/support/kb.asp?ID=249599. - Microsoft TechNet Security web site, http://www.microsoft.com/technet/security/default.asp. Obtaining Support on this Issue =============================== This is a fully supported patch. Information on contacting Microsoft Technical Support is available at http://support.microsoft.com/support/contact/default.asp. Revisions ========= - March 30, 2000: Bulletin Created. - -------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Last updated March 30, 2000 (c) 2000 Microsoft Corporation. All rights reserved. Terms of use. -----BEGIN PGP SIGNATURE----- Version: PGP 6.0.2 iQEVAwUBOOOgXo0ZSRQxA/UrAQEKjAf9GVsx2758Za9+fAyEYFmoQ0xaSHK0QAXh 7PCWw5L4bYwjZsVeFrLLn0oNRq2bqE+Fl+8vEU3K2Iu5Lj+Uco23Of500PQQdNLv lRFPXaRLr9vIOYfE1H8qeDuvsOSxP0uTEXesOgLpmTnN0laq8ujqmohW5Oaz+Hzk UIcuePCQU5Ff5TwOOqGpNfgSgRnX+U6+G/r1GjcJDCImbEIr6sCsU4j04Hs4NC0G tUDYhcjPfCHfsOXKE81kbNF/dOcBu6fh9fQlgtaBfxm0MLI9hVkJRRgajXeR0Vsh oB3fQ1HkED/2kyEbQTQbAUeF2c6xodLYTaQPN7PM0mnrLNhoDc3n5Q== =qKLR -----END PGP SIGNATURE----- ******************************************************************* You have received this e-mail bulletin as a result of your registration to the Microsoft Product Security Notification Service. You may unsubscribe from this e-mail notification service at any time by sending an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST () ANNOUNCE MICROSOFT COM The subject line and message body are not used in processing the request, and can be anything you like. To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp. For more information on the Microsoft Security Notification Service please visit http://www.microsoft.com/technet/security/notify.asp. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.
Current thread:
- Trend Micro releases Patch for "OfficeScan Unauthenticated CGI U sage" vulnerability, (continued)
- Trend Micro releases Patch for "OfficeScan Unauthenticated CGI U sage" vulnerability Richard Sheng (Mar 22)
- Re: gpm-root Koblinger Egmont (Mar 23)
- Local Denial-of-Service attack against Linux Jay Fenlason (Mar 23)
- Re: Local Denial-of-Service attack against Linux Michal Zalewski (Mar 24)
- Re: Local Denial-of-Service attack against Linux dapozza (Mar 24)
- Hide Drives does not work with OUTLOOK 98 - Summary of Answers (W InNT4) DeAvillez, Carlos (Mar 24)
- Windows 2000 Internet Server Security Configuration Tool Microsoft Security Response Center (Mar 24)
- Irix Objectserver remote exploit Marcy Abene (Mar 29)
- New ZZ v1.2 Simple Nomad (Mar 29)
- [RHSA-2000:008-01] ircii buffer overflow bugzilla () REDHAT COM (Mar 30)
- Microsoft Security Bulletin (MS00-019) Microsoft Product Security (Mar 30)
- Microsoft Security Bulletin (MS00-021) Microsoft Product Security (Mar 30)
- Napster, Inc. response to Colten Edwards Elias Levy (Mar 30)
- Cobalt apache configuration exposes .htaccess Paul Schreiber (Mar 30)
- Re: Napster, Inc. response to Colten Edwards Danny Crawford (Mar 30)
- Re: Napster, Inc. response to Colten Edwards Dylan Griffiths (Mar 30)
- Alert: MS Index Server (CISADV000330) Cerberus Security Team (Mar 30)
- Webstar 4.0 Buffer overflow vulnerability Ilhom Djalilov (Mar 31)
- Microsoft Security Bulletin (MS00-006) Microsoft Product Security (Mar 31)
- [ Cobalt ] Security Advisory -- 03.31.2000 Jeff Lovell (Mar 31)
- SalesLogix Eviewer Web App Bug: URL request crashes eviewer web application Todd Beebe (Mar 31)