CA-2003-09 Buffer Overflow in Microsoft IIS 5.0

Article View: be.comp.security

Article #1486

#1486

From: Jan Reilink
Date: Mon, 17 Mar 2003 22:16

25 lines
2538 bytes

[Notice the crosspost! Sorry guys/gals]

http://www.cert.org/advisories/CA-2003-09.html
	" A buffer overflow vulnerability exists in Microsoft IIS
	5.0 running on Microsoft Windows 2000. IIS 5.0 is installed
	and running by default on Microsoft Windows 2000 server
	products. This vulnerability may allow a remote attacker to
	run arbitrary code on the victim machine.

	An exploit is publicly available for this vulnerability,
	which increases the urgency that system administrators apply
	a patch."
	...
	...
	"Impact
	Any attacker who can reach a vulnerable web server can gain
	complete control of the system and execute arbitrary code in
	the Local System security context. Note that this may be
	significantly more serious than a simple "web defacement.""

Groeten/Regards, Jan

-- 
Dutch Security Information Network
http://www.dsinet.org/

Technical Details

Message-ID: <3E764949.3070900@dsinet.org>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-04!sn-xit-01!sn-xit-08!supernews.com!news.tele.dk!news.tele.dk!small.news.tele.dk!news-x2.support.nl!post.news-service.com!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 115ed4,f8f787ca1e5b43ac,start
X-Google-Attributes: gid115ed4,public
X-Google-Thread: 102c45,f8f787ca1e5b43ac,start
X-Google-Attributes: gid102c45,public
X-Google-Thread: 113446,f8f787ca1e5b43ac,start
X-Google-Attributes: gid113446,public
X-Google-Thread: fbc6f,f8f787ca1e5b43ac,start
X-Google-Attributes: gidfbc6f,public
X-Google-ArrivalTime: 2003-03-17 14:16:44 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-04!sn-xit-01!sn-xit-08!supernews.com!news.tele.dk!news.tele.dk!small.news.tele.dk!news-x2.support.nl!post.news-service.com!not-for-mail
From: Jan Reilink <digiover@dsinet.org>
Newsgroups: be.comp.security,alt.hacker,alt.hacking,alt.hack.nl
Subject: CA-2003-09 Buffer Overflow in Microsoft IIS 5.0
Date: Mon, 17 Mar 2003 23:16:41 +0100
Organization: Dutch Security Information Network : http://www.dsinet.org
Lines: 26
Message-ID: <3E764949.3070900@dsinet.org>
NNTP-Posting-Host: cache3.news.news-service.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: news1.news.support.nl 1047939371 12978 172.24.8.13 (17 Mar 2003 22:16:11 GMT)
X-Complaints-To: abuse@news-service.com
NNTP-Posting-Date: Mon, 17 Mar 2003 22:16:11 +0000 (UTC)
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.0) Gecko/20020623 Debian/1.0.0-0.woody.1
Cache-Post-Path: news.knoware.nl!unknown@246.169.213-173-dial-in-dynamic.ision.nl
X-Cache: nntpcache 2.4.0b2 (see http://www.nntpcache.org/)
Cache-Post-Path: cache3!unknown@news.knoware.nl
X-Cache: nntpcache 3.0.1+tl2 (see http://www.nntpcache.org/)