[SNS Advisory No.49] A Possibility of Internet Information Server/Services Cross Site Scripting

From: snsadvat_private
Date: Thu Apr 11 2002 - 02:33:54 PDT

Next message: Przemyslaw Frasunek: "local root compromise in openbsd 3.0 and below"

Previous message: kriskat_private: "RE: Windows 2000 Sec rollup 2 patch -- Ouch!"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------
SNS Advisory No.49
A Possibility of Internet Information Server/Services Cross Site Scripting

Problem first discovered: Fri, 11 Jan 2002
Published: Thu, 11 Apr 2002
----------------------------------------------------------------------

Overview:
---------
  Microsoft Internet Information Server/Services (IIS) is prone to a 
  potential Cross Site Scripting vulnerability. 

Details:
--------
  When a request is submitted to IIS, it returns a "302 Object Moved" 
  error message to the client without changing the metacharacters 
  contained in the request.  This occurs when the request contains the 
  following URI:  

  GET /existing directory name?"><script>alert("aaa"); </script>

Affected Versions:
------------------
  Microsoft Internet Information Server 4.0
  Microsoft Internet Information Services 5.0
  Microsoft Internet Information Services 5.1

Solution:
---------
  This vulnerability can be eliminated by applying the following patch 
  available at: 

  Microsoft Security Bulletin MS02-018:
  http://www.microsoft.com/technet/security/bulletin/ms02-018.asp

  Microsoft Security Bulletin MS02-018(Japanese version):
  http://www.microsoft.com/japan/technet/security/bulletin/MS02-018.asp

Discovered by:
--------------
  Keigo Yamazaki

Disclaimer:
-----------
  All information in these advisories are subject to change without any 
  advanced notices neither mutual consensus, and each of them is released 
  as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences 
  caused by applying those information. 

References:
-----------
  Archive of this advisory:
  http://www.lac.co.jp/security/english/snsadv_e/49_e.html

------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadvat_private>
Computer Security Laboratory, LAC  http://www.lac.co.jp/security/
-------------------------------------------------------------------

Next message: Przemyslaw Frasunek: "local root compromise in openbsd 3.0 and below"
Previous message: kriskat_private: "RE: Windows 2000 Sec rollup 2 patch -- Ouch!"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Apr 11 2002 - 13:42:01 PDT