Code: p103 Severity: Notice
Description: Internet Information Server 4.0 can perform server-side processing via specific file types. Vulnerability exists in the way that .HTR, .STM, and .IDC files are processed. Requests for files ending with these file name extensions are passed to the appropriate external DLL for processing. These DLLs contain unchecked buffers that could allow a long request to overflow these buffers and crash the IIS service. This hole has also been demonstrated to allow remote execution of arbitrary code and exploits have been made widely available. Impact: Any system with IIS 4.0 installed Corrective Apply the Internet Information Server 4.0 ext-fix update. 1. Open a Web browser. 2. Go to ftp://ftp.microsoft.com/bussys/IIS/iis-public/fixes/usa/ext-fix/. 3. View the readme.txt for versions and install instructions. 4. Download the appropriate patch for your operating environment. 5. Find the patch file you downloaded to your computer. 6. Double-click its icon to start the installation. 7. Follow the installation directions. Code:p104 Name:HTTP_ASP_Dot Description: By adding a "." into the asp file name??s end, an attacker could read the document from server. When the entered URL contains "/ sdkjfh.asp.??, triggering the event. Impact: Microsoft IIS versions 3.x?? Corrective: If this vulnerability exists, the system has been considered to be unsafe, should take corresponding measures. Update the system or patch.
|
