Microsoft IIS 4.0 Buffer Overflow in Redirect Function Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1010692
|
|
SecurityTracker URL: http://securitytracker.com/id?1010692
|
|
CVE Reference: CAN-2004-0205
(Links to External Site)
|
Date: Jul 13 2004
|
Impact: Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 4.0
|
Description: A buffer overflow vulnerability was reported in Microsoft Internet Information Server (IIS) 4.0. A remote user can execute arbitrary code on the target system.
Microsoft reported that there is an unchecked buffer in the IIS 4.0 redirect function. A remote user can send a specially crafted message to the target web server to trigger the buffer overflow and execute arbitrary code, the report said.
|
Impact: A remote user can execute arbitrary code on the target system with System level privileges.
|
Solution: The vendor has issued the following fixes:
Microsoft Windows NT Workstation 4.0 Service Pack 6a:
http://www.microsoft.com/downloads/details.aspx?FamilyId=3A2B38C5-F
A73-49EC-9EEF-06FE8D6495C0&displaylang=en
Microsoft Windows NT Server 4.0 Service Pack 6a:
http://www.microsoft.com/downloads/details.aspx?FamilyId=3A2B38C5-FA73-
49EC-9EEF-06FE8D6495C0&displaylang=en
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-021.mspx (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (NT)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 13 Jul 2004 15:50:18 -0400
Subject: http://www.microsoft.com/technet/security/bulletin/ms04-021.mspx
|
Microsoft Security Bulletin MS04-021
Security Update for IIS 4.0 (841373)
Microsoft Internet Information Server (IIS) 4.0
Microsoft® Windows® NT® 4.0
Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Important
Microsoft Windows NT® Workstation 4.0 Service Pack 6a:
http://www.microsoft.com/downloads/details.aspx?FamilyId=3A2B38C5-FA73-49EC-9EEF-06FE8D6495C0&dis
playlang=en
Microsoft Windows NT Server 4.0 Service Pack 6a:
http://www.microsoft.com/downloads/details.aspx?FamilyId=3A2B38C5-FA73-49EC-9EEF-06FE8D6495C0&dis
playlang=en
|
|
