IIS buffer-overrun attack has been scripted
Print storyNo skillz? No worriez
Posted in Software, 6th July 2001 07:42 GMT
Understand how application security is evolving
A Japanese computer enthusiast named 'HighSpeed Junkie' has developed an attack script for a recently-identified unchecked buffer in the Microsoft IIS (Internet Information Services) Indexing Service ISAPI filter, which, if exploited, can yield system-level access to an intruder.
At issue is IDQ.DLL, a component of Index Server (or 'Indexing Service' in W2K) which supports administrative scripts (.IDA files) and Internet Data Queries (.IDQ files). The library is installed by default on all IIS versions and implementations.
The service need not be running for an attacker to exploit the vulnerability. So long as script mapping for .IDQ or .IDA files is present and an attacker can establish a Web session, the exploit will work.
The vulnerability was first reported by eEye Security on 18 June. The attack script was released on 21 June, and posted to the Win2KSecAdvice mailing list on 27 June.
Patches are available for NT and 2K, except for W2K Datacenter Server, whose users need to bug their OEMs. The hole will be bunged in Win-XP before it and its Raw Socket Terror are unleashed upon the public. ®
Related Links
The relevant MS security bulletin
The Win-NT 4.0 patch
The Win-2K Pro and Advanced Server patch
The Total Economic Impact of Dell's PC products and services
The best practices guide for application security
Airport insecurity: the case of lost laptops
The mandate for application security
Essential archive requirements for eDiscovery
Why Google Wave makes Tim Bray nervous
Microsoft kills Visual Studio's Oracle data connection
Opera Software reinvents complete irrelevance
Microsoft's Bing feeds you, tries to keep you captive