--ZGiS0Q5IWpPtfppv Content-Type: text/plain; charset=us-ascii --ZGiS0Q5IWpPtfppv Content-Type: message/rfc822 Content-Description: Forwarded message from Fabien Royer <fabienrat_private> Received: (qmail 4091 invoked from network); 8 Mar 1999 20:35:44 -0000 Received: from dfw.nationwide.net (@198.175.15.10) by underground.org with SMTP; 8 Mar 1999 20:35:44 -0000 Received: from VMS.DC.LSOFT.COM (vms.dc.lsoft.com [209.119.1.27]) by dfw.nationwide.net (8.9.0/8.9.0) with ESMTP id NAA18735 for <aleph1at_private>; Mon, 8 Mar 1999 13:20:58 -0600 (CST) Received: from peach (209.119.0.4) by VMS.DC.LSOFT.COM (LSMTP for OpenVMS v1.1a) with SMTP id <2.04CA0AD3at_private>; Mon, 8 Mar 1999 14:18:37 -0500 Received: from LISTSERV.NTBUGTRAQ.COM by LISTSERV.NTBUGTRAQ.COM (LISTSERV-TCP/IP release 1.8c) with spool id 64303 for NTBUGTRAQat_private; Mon, 8 Mar 1999 14:22:38 -0500 Approved-By: Russ.Cooperat_private Received: from 199.45.39.157 by PEACH.EASE.LSOFT.COM (SMTPL release 1.0d) with TCP; Mon, 8 Mar 1999 11:29:40 -0500 Received: from teddy (client-151-197-118-94.bellatlantic.net [151.197.118.94]) by smtp-out2.bellatlantic.net (8.9.1/8.9.1) with SMTP id LAA18717 for <NTBUGTRAQat_private>; Mon, 8 Mar 1999 11:30:05 -0500 (EST) MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal Importance: Normal X-Mimeole: Produced By Microsoft MimeOLE V4.72.3155.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-ID: <001201be6980$9aaa1240$0b0a0a0aat_private> Date: Mon, 8 Mar 1999 11:27:48 -0500 Reply-To: Fabien Royer <fabienrat_private> Sender: Windows NT BugTraq Mailing List <NTBUGTRAQat_private> From: Fabien Royer <fabienrat_private> Subject: ISAPI Extension vulnerability allows to execute code as SYSTEM To: NTBUGTRAQat_private There's a vulnerability in IIS (and other WEB servers executing as SYSTEM) that allows to execute an ISAPI extension in the security context of the server itself instead of the security context of IUSR_WHATEVER. How is this possible: when the server loads an ISAPI extension the first time, it calls GetExtensionVersion(). During the call to this function, an attacker can execute any code as SYSTEM. This is a problem if you're an ISP doing hosting with web servers offering ISAPI support (IIS, Apache 1.3.4, etc. ) because any user allowed to place a "CGI" on the server can take over. Of course, this problem is not limited to ISPs. Fabien. --ZGiS0Q5IWpPtfppv--
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:38:16 PDT