Microsoft Internet Information Server (IIS) FTP Server Buffer Overflows Let Remote Authenticated Users Execute Arbitrary Code and Deny Service
|
|
SecurityTracker Alert ID: 1022792 |
|
SecurityTracker URL: http://securitytracker.com/id/1022792
|
|
CVE Reference:
CVE-2009-2521, CVE-2009-3023
(Links to External Site)
|
Updated: Oct 13 2009
|
Original Entry Date: Aug 31 2009
|
Impact:
Denial of service via network, Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 5.0, 5.1, 6.0, 7.0
|
Description:
Two vulnerabilities were reported in Microsoft Internet Information Server (IIS) FTP Server. A remote authenticated user (including anonymous users) can execute arbitrary code on the target system or cause denial of service conditions.
A remote authenticated user (including an anonymous user) can send specially crafted FTP commands to the FTP service to trigger a stack overflow and execute arbitrary code on the target system. The code will run with the System privileges.
A remote authenticated user (including an anonymous user) can send specially crafted FTP commands to the FTP service to cause all services hosted by the inetinfo process to become unavailable.
Remote code execution is possible on IIS version 5.0 running on Windows 2000 SP4. Denial of service conditions can be caused on versions 5.0, 5.1, 6.0, and 7.0.
Demonstration exploit code is available at:
http://www.milw0rm.com/exploits/9541
In the exploit code, the buffer overflow is triggered by a specially crafted FTP NLST command, preceded by some specially crafted FTP MKD, CWD, and PORT commands.
Kingcope reported this vulnerability.
|
Impact:
A remote authenticated user can execute arbitrary code on the target system with System privileges.
A remote authenticated user can cause inetinfo processes to become unavailable.
|
Solution:
The vendor has issued the following fixes:
Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?familyid=7fecd367-aaff-458b-91bc-8925c8e57528
Windows XP Service Pack 2 and Windows XP Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=2ae0bdd4-f8b2-420a-b1ac-d2cdaa87c828
Windows XP Professional x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=819dd2d1-cad5-4784-9baf-185d8a76df5d
Windows Server 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=48256ea3-b433-4e84-9019-22300069cfc1
Windows Server 2003 x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=61bded07-201e-4815-ac1e-468bf907e063
Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=b99d4d9b-e0cc-4a8c-ad99-6a53958b37c8
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=bb96eb1c-66a2-4276-9773-eea22179bcd4
Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=bce096c8-833b-45c8-99cd-1280f0744f2f
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=d9c5039f-d0cf-4d84-850f-f2f7701dcb79
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=db969ddc-708e-42b7-9956-6c27bf346bbb
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=a221451a-cb4e-4a43-a225-4b1e86e87525
A restart may be required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms09-053.mspx
The vendor's original advisory is available at:
http://www.microsoft.com/technet/security/advisory/975191.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms09-053.mspx (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Windows (2000), Windows (2003), Windows (2008), Windows (Vista), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
