Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Home  Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key). Network Enabled Discount: SecuriTeam5_SANS Promo With Us Subjects of Interest: Vulnerability Management SQL Injection Buffer Overflows Active Network Scanning Fuzzing Fuzzer Report Network Security Network Scanner Pen Testing Security Scanner Scanner Review Fuzzer Review Web Scanner Review	Microsoft IIS 5.0 CodeBrws.asp Source Disclosure 17 Apr. 2002    Summary Microsoft's IIS 5.0 web server is shipped with a set of sample files to demonstrate different features of the ASP language. One of these sample files allows a remote user to view the source of any file in the web root with the extension .asp, .inc, .htm, or .html. The IISSamples virtual directory should not be left on production servers in the first place, but up until now, there were no serious (See note #1) vulnerabilities found in those sample scripts. Microsoft was not contacted about this, they can read the lists like everyone else. This issue can be fixed by proper system administration.   Credit: The information has been provided by H D Moore. Free Website Security Scan Free Fuzzer Report Vulnerability Assessment Detect web app vulnerabilities University study comparing the top Accurate and automated scanning Get guidance from professionals. 6 commercially availble fuzzers. for networks of any size.    Details Protect your website! Free Trial, Nothing to install. No interruption of visitors. www.beyondsecurity.com/vulnerability-scanner The IIS developers actually put some thought into securing this sample script. Unfortunately, for them and their user base, they did not take into account the Unicode character set when checking the path passed to the script. The function fValidPath in CodeBrws.asp has the following comment placed above it:         REM **************************************         REM intended behavior:         REM allow access to only .asp, .htm, .html, .inc files         REM in some directory starting from /IISSAMPLES         REM and without .. in the path         REM ************************************** The fValidPath function first checks to see if the base directory starts with "/IISSAMPLES", then verifies that the last characters of the request are one of the allowed extensions, and finally checks to see if the ".." sequence is anywhere in the string. The problem is that ".." can be represented a number of other ways using the Unicode character set. For instance, the sequence %c0%ae%c0%ae will be decoded as two periods by IIS, but will not be caught by the InStr(1,strPath,"..",1) code in the ASP script. Therefore, to create a request that passes the input filters but retrieves the source of default.asp:   /iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp Solution: Remove the /IISSamples virtual directory using the Internet Services Manager. If for some reason this is not possible, removing the following ASP script will fix the problem:         This path assumes that you installed IIS in c:\inetpub                      c:\inetpub\iissamples\sdk\asp\docs\CodeBrws.asp Note #1: While all versions of IIS before 5.0 had significant problems with the bundled sample scripts, IIS 5.0 has only had a couple information gathering issues to date. Due to the lowered risk, many administrators have left the IISSamples virtual directory mapped on their production servers.  Comments: blog comments powered by Disqus	Related Articles Microsoft Windows Local Privilege Escalation Vulnerabilities Microsoft Office Use After Free Memory Corruption Vulnerabilities Microsoft Internet Explorer Execute Arbitrary Code Remote Memory Corruption Vulnerabilities Microsoft Internet Explorer Cross-Domain Information Disclosure Vulnerabilities Microsoft Windows TCP/IP Stack Privilege Escalation Vulnerabilities Microsoft Windows OLE Code Execution Vulnerabilities Microsoft Internet Explorer Cross-Domain Execute Arbitrary Code Vulnerabilities Microsoft SharePoint Server Privilege Escalation Vulnerabilities Microsoft Office Invalid Pointer Memory Corruption Vulnerabilities Microsoft Internet Explorer Privilege Escalation Vulnerabilities Microsoft Windows Kernel Mode Driver Denial Of Service Vulnerabilities Microsoft Secure Channel Code Execution Vulnerabilities Microsoft Internet Explorer Denial-Of-Service Memory Corruption Vulnerabilities Microsoft Internet Explorer Cross-Domain Obtain Sensitive Information Vulnerabilities Microsoft OLE Automation Array Code Execution Vulnerabilities Microsoft XML Core Services Remote Code Execution Vulnerabilities Microsoft Internet Explorer Cross-Domain Memory Corruption Vulnerabilities Microsoft Windows Kerberos Checksum Remote Privilege Escalation Vulnerabilities Microsoft Windows Audio Service Privilege Escalation Vulnerabilities Microsoft Input Method Editor (IME) For Japanese Remote Privilege Escalation Vulnerabilities  Featured Articles Microsoft Windows Graphics Component Remote Code Execution Vulnerabilities Microsoft Windows Local Remote Procedure Call (LRPC) Server Spoofing LPC Port Message Handling Local Stack Buffer Overflow Vulnerability Microsoft SharePoint Server Multiple Component Crafted Page Content Handling Remote Code Execution Vulnerability Microsoft Windows Win32k.sys RFONTOBJ bTextExtent Function Handling Local Integer Overflow DoS Vulnerability Microsoft Windows Kernel Memory Object Handling Race Condition Local Privilege Escalation (2013-1294) Vulnerability Microsoft Windows Win32k.sys Memory Object Handling Race Condition Local Privilege Escalation (2013-1283) Vulnerability Microsoft Visio Viewer Tree Object Type Confusion Visio File Handling Arbitrary Code Vulnerability Microsoft Office for Mac HTML5 Email Message Unspecified Content Tag Loading Information Disclosure Vulnerability Microsoft SharePoint Callback Function URL Handling Privilege Escalation Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege (2013-1287) Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege Escalation Vulnerability Microsoft Windows Kernel Memory Object Handling Local Privilege Escalation Vulnerability Microsoft Windows SSL/TSL Forced Downgrade MitM Weakness Microsoft Windows Memory Object Handling Local Memory Privilege Escalation Vulnerability Microsoft Windows Privilege Escalation Vulnerability Microsoft .NET Framework Serialization Remote Code Execution Vulnerability Microsoft Visio Viewer VSD File Format Remote Code Execution Vulnerability Microsoft .NET Framework Input Serialization CVE-2012-0160 Remote Code Execution Vulnerability Microsoft .NET Framework ASP.NET Forms Authentication Bypass Vulnerability 'TrendMicro Control Manager CASProcessor.exe BLOB Code Execution Vulnerability'
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®