|
|
|
|
| |
Microsoft Windows Media Services is a feature of Microsoft Windows 2000 Server, Advanced Server, and Datacenter Server and is also available in a downloadable version for Windows NT 4.0 Server. Windows Media Services contains support for a method of delivering media content to clients across a network known as multicast streaming. In multicast streaming, the server has no connection to or knowledge of the clients that may be receiving the stream of media content coming from the server. To facilitate logging of client information for the server, Windows 2000 includes a capability specifically designed to enable logging for multicast transmissions.
This logging capability is implemented as an Internet Services Application Programming Interface (ISAPI) extension - nsiislog.dll. When Windows Media Services are added through add/remove programs to Windows 2000, nsiislog.dll is installed in the Internet Information Services (IIS) Scripts directory on the server. Once Windows Media Services is installed, nsiislog.dll is automatically loaded and used by IIS.
There is a flaw in the way nsiislog.dll processes incoming client requests. A vulnerability exists because an attacker could send specially formed HTTP request (communications) to the server that could cause IIS to fail or execute code on the user's system.
Windows Media Services is not installed by default on Windows 2000. An attacker attempting to exploit this vulnerability would have to be aware which computers on the network had Windows Media Services installed on it and send a specific request to that server. |
| |
Credit:
The information has been provided by Microsoft Product Security.
|
| |
Affected Software:
* Microsoft Windows 2000
Not Affected Software Versions:
* Windows NT 4.0
* Microsoft Windows XP
* Microsoft Windows Server 2003
Mitigating factors:
* Windows Media Services 4.1 is not installed by default on Windows 2000.
* Windows Media Services are not available for Windows 2000 Professional.
Patch availability:
Download locations for this patch
* Microsoft Windows 2000:
http://microsoft.com/downloads/details.aspx?FamilyId=F772E131-BBC9-4B34-9E78-F71D9742FED8&displaylang=en
What's the scope of the vulnerability?
This is a Buffer Overrun vulnerability. An attacker who successfully exploited this vulnerability could cause a Windows 2000 server that was performing streaming media logging to fail in a way that could allow code to execute in the security context of the IIS service.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by constructing a specific network request and sending it to the server running Windows Media Services. The attacker would have to know which server on the network or Internet had Windows Media Services installed in order to cause the server to stop responding to IIS requests or cause code to execute in the server.
What could this vulnerability enable an attacker to do?
This vulnerability could enable an attacker to execute code of his or her choice on a computer running IIS with Windows Media Services installed. The code would execute in the context of the account under which IIS was running, which could allow the attacker to take any action on the system.
What causes the vulnerability?
The vulnerability results because of an unchecked buffer used by nsiislog.dll, the streaming media component that is used to log multicast requests. If a specially crafted request was sent to the server, the logging program would attempt to write a larger buffer than was available, which then in turn could cause the IIS service to fail and could allow code of the attacker's choice to execute.
What is nsiislog.dll?
Nsiislog.dll is an IIS ISAPI extension that is included with Windows 2000 Server. It provides logging capabilities for Media Streaming in Microsoft Windows Media Services. It is installed and used automatically whenever Windows Media Services are installed on a computer.
What versions of IIS might be affected by the vulnerable version of nsiislog.dll?
The vulnerable version of nsiislog.dll can be installed on IIS 5.0.
What products does IIS 5.0 ship with?
Internet Information Service 5.0 is included with Windows 2000 Datacenter Server, Advanced Server, Server and Professional.
Does IIS 5.0 run by default?
IIS 5.0 runs by default on all Windows 2000 server products. It does not run by default on Windows 2000 Professional.
What are Microsoft Windows Media Services?
Windows Media Services is a feature of Windows 2000 Server, Advanced Server, and Datacenter Server and provides streaming audio and video services for use over corporate intranets and the Internet.
Can I install Windows Media Services on Windows 2000 Professional?
No - Windows Media Services are only available for Microsoft Windows Server operating systems, such as Windows 2000 Server, Advanced Server and Datacenter Server.
Does this vulnerability affect Windows Media Services on Windows NT 4.0?
That depends. If you have applied the previous patch for Windows Media Servers from security bulletin MS03-019, this vulnerability does not affect Windows NT 4.0.
What is Multicast Media Streaming?
Multicast media streaming is a method of delivering media content to clients across a network. In contrast to unicast media streaming, multicasting sends a single copy of the data that can be received by any clients that request it. Multiple copies of data are not sent across the network, nor is data processed by clients who do not request it. For more information on Multicast Media Streaming, please see the following web site: http://www.microsoft.com/windows/windowsmedia/serve/multiwp.aspx
How can I determine whether someone has set up my computer to perform multicast streaming media logging?
If you have installed Windows Media Services on Windows 2000 Server, then the nsiislog.dll file is automatically copied to the proper IIS directory and loaded. To determine if nsiislog.dll is installed on the computer, perform the following steps:
* From the Start Menu, click search.
* Click For Files or Folders
* In the search dialog, type in the file name, NSIISLOG.DLL
* Click Search Now.
If the file NSISSLOG.DLL is present in any directory shared by IIS, then the server is configured for logging clients of multicast streams.
What does the Patch do?
The fix eliminates the vulnerability by ensuring that the Nsiislog.dll file correctly responds to requests.
|
|
|
|
|
|
|
