H-77: Microsoft IIS Boundary Condition Vulnerability

PROBLEM:       A vulnerability in Microsoft Internet Information Server (IIS) 
               allows an outside user to cause an access violation on a server 
               ("denial of service"). 
PLATFORM:      Windows NT servers running Internet Information Server 2.0 or 
               3.0. 
DAMAGE:        Causes an access violation (i.e., server is unresponsive). 
               Unsaved data is lost. 
SOLUTION:      Apply the local Microsoft patch described below. 
VULNERABILITY  Exploit is widely available, and attack can be successfully 
ASSESSMENT:    executed remotely. 


Introduction:

A vulnerability in Microsoft Internet Information Server (IIS) for Windows NT 
4.0 allows users to locally or remotely cause an access violation on a  Web 
server of this configuration.  The result is the server crashes, and is 
therefore rendered unresponsive until rebooted.  To determine whether your IIS 
server has been successfully attacked, this access violation may be seen in 
Event Viewer's Application log file as a Dr. Watson entry of access violation 
on the INETINFO.EXE process.

Problem:

A Web browser sends a request such as a URL to the IIS Web server.  If the 
request is a certain length, the sender causes an access violation on the 
server. This length varies from server to server, but typically ranges between 
4K and 8K.  Code is available which sends requests of varying sizes (lengths) 
to the target IIS server.  Through this "trial and error", the code will 
eventually send the exact size request needed to render the target server 
unresponsive.

Solution:

If your server  has been successfully attacked, it must be rebooted. The 
system operates normally once the system is rebooted.

Prevention:

Microsoft has developed a local patch to prevent users from successfully 
accomplishing this attack.  This patch detects when the specific URL length  
is reached in IIS.  CIAC recommends that you update your Emergency Repair Disk 
before you apply the patch, as the patch has not been regression tested and 
therefore may not work as described.

Microsoft's patch location: 

Windows NT 4.0 (CIAC recommends that Service Pack 3 is installed first):

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-
postSP3/iis-fix/

===========================================================================






CIAC services are available to DOE, DOE Contractors, and the NIH. CIAC
can be contacted at:
    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org




This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.


UCRL-MI-119788 

[Privacy and Legal Notice]