Vulnerability in Microsoft Internet Information Services Allows Code Execution (MS07-041)
11 Jul. 2007
This important security update resolves a privately reported vulnerability. This vulnerability could allow remote code execution if an attacker sent specially crafted URL requests to a Web page hosted by Internet Information Services (IIS) 5.1 on Windows XP Professional Service Pack 2. IIS 5.1 is not part of a default install of Windows XP Professional Service Pack 2. An attacker who successfully exploited this vulnerability could take complete control of the affected system.
* Windows 2000 Service Pack 4
* Windows XP Home Service Pack 2
* Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems
* Windows Vista
* Windows Vista x64 Edition
There is a remote code execution vulnerability in Internet Information Services (IIS) 5.1 on Windows XP Professional Service Pack 2 that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system. An attacker could exploit the vulnerability by sending specially crafted URL requests to a Web page hosted by Internet Information Services.
Workarounds for IIS Memory Request Vulnerability - CVE-2005-4360
Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section. It is recommended that customers use versions of IIS included in server editions of Windows and use the version of IIS included in Windows XP Professional Service Pack 2 for development and testing of Web sites and Web pages.
* Use URLScan 2.5
The installation of URLScan helps protect the affected system from attempts to exploit this vulnerability.
1. Install URLScan, using the default URLScan.ini settings.
2. Restart the IISAdmin and WWW Publishing services for the changes to take effect.
* To help protect from network-based attempts to exploit this vulnerability, block access to port 80 (TCP) using:
* Windows Firewall.
* Internet Protocol security (IPSec). Detailed information about IPSec and about how to apply filters is available in Microsoft Knowledge Base Article 313190 and Microsoft Knowledge Base Article 813878.
Additional ports where Web content is hosted by IIS should also be blocked.