Microsoft IIS hole gives System-level access

Strong words from the official voice of Redmond today, urging admins to patch a recently-discovered buffer overflow vulnerability in servers running IIS 5.0 on Windows 2000 Server, Windows 2000 Advanced Server and Windows 2000 Datacenter Server, make it clear how serious a security problem the Beast has on its hands.

"Microsoft strongly urges all IIS 5.0 server administrators to install the patch immediately," a company security bulletin says.

The vulnerability was discovered less than a fortnight ago by engineers from eEye Digital Security, while upgrading a network scanner it makes called Retina.

Once upgraded to audit the .printer ISAPI (Internet Server Application Programming Interface) filter (C:\WINNT\System32\msw3prt.dll), which enables Web-based control of networked printers, the Retina implementation reported a buffer overflow which eEye soon found to be exploitable.

Web-based printer support is enabled by default in IIS, unfortunately, so a great many users will be affected.

The vulnerability occurs when a buffer of approximately 420 bytes is sent within the HTTP Host: header for a .printer ISAPI request. Because Win 2K is equipped with a lovely feature which automatically restarts the Web server after a crash, an attacker can gain easy access.

"There are roughly five million Web sites running IIS," eEye Chief Hacking Officer Marc Maiffret told The Register. "If only one million users have upgraded to IIS 5.0 -- a conservative estimate -- then it's obvious how serious this is."

We spoke also with Bill Wall, Chief Computer Security Engineer with the STAT division of Harris Corporation, who confirmed with his own tests that the eEye exploit does in fact work as advertised, quickly and easily giving up system-level control of a Win2K machine.

It's hardly a mystery that a flaw like this exists. The issue, he said, is that the ISAPI filter does inadequate bounds checking on buffers, which leaves the system vulnerable to buffer overflow attacks. "With millions of lines of code to audit, it's no surprise to find calls without adequate limitations," he noted.

"Roughly eighty per cent of vulnerabilities are actually buffer overflows," Wall estimated.

Harris's competing product, STAT Scanner, will be upgraded to include the eEye vulnerability within a few days, he told us.

Marketing windfall

The timing of this discovery couldn't be handier for eEye, as it's got an application firewall called SecureIIS, which works within the IIS process monitoring all incoming requests for signs of attack, which it can then shut down automatically.

As fate would have it, eEye had distributed beta versions of SecureIIS just before it discovered the printer vulnerability. Testers have reported that their systems are not susceptible to it, even though their versions of SecureIIS were developed before it could be taken into account.

Naturally we had to question eEye's Maiffret about the extraordinary convenience, from a marketing perspective, in the timing of today's announcement.

"That's a fair suspicion," he said affably. "But we're confident that it will catch the next one, and the one after that, without any modification or input from users."

We're sure he knows we'll be monitoring this in future, which does lend an air of credibility to the claim. ®