INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | Microsoft's Visual Studio Remote Application Deployment (RAD) Support has a buffer overflow vulnerability. |
| PLATFORM: | Those that have RAD installed on IIS 4.0 or IIS 5.0 web servers. |
| DAMAGE: | An attacker could use the vulnerability to load and execute artibrary code on the server in the IUSR_machine context and possibly in the SYSTEM context. |
| SOLUTION: | Remove RAD from the server, or apply the patch as directed. |
| VULNERABILITY ASSESSMENT: |
The risk is LOW. RAD is not installed by default onto the server. The installation process raises a warning that RAD should not be installed on production systems. The warning must be actively acknowledged for RAD to be installed. |
[Start Microsoft Advisory]
----------------------------------------------------------------------
Title: FrontPage Server Extension Sub-Component Contains
Unchecked Buffer
Date: 21 June 2001
Software: Microsoft Visual Studio RAD Support in FrontPage
Server Extensions
Impact: Run code of attacker's choice
Bulletin: MS01-035
Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-035.asp.
----------------------------------------------------------------------
Issue:
======
FrontPage Server Extensions ship as part of IIS 4.0 and 5.0, and
facilitate the development of
Web sites and Web-based applications. FrontPage Server Extensions
includes an additional,
optional sub-component called Visual Studio RAD (Remote Application
Deployment) Support.
This sub-component allows Visual InterDev 6.0 users to register and
unregister COM objects on
an IIS 4.0 or 5.0 Server. This sub-component contains an unchecked
buffer in a section that
processes input information.
An attacker could exploit this vulnerability against any server with
this sub-component installed by
establishing a web session on with the server and passing a specially
malformed packet to the
server component. The attacker could use that packet to thereby load
code of his choice for
execution on the server. An attack that exploits this vulnerability
would execute in the
IUSR_machinename context (see Q142868). However, it is possible under
certain circumstances
to execute code in the SYSTEM context.
It is important to note that this feature is not installed by default
with FPSE. It is also not installed
by default on either of IIS 4.0 or 5.0. Also, when the feature is
selected during installation, a
warning message is raised alerting the administrator that this
feature should not be installed on
production machines, especially if the production machine has
Internet access. This is because
this feature is only intended for facilitating internal development.
The administrator must
acknowledge the warning to successfully install the feature.
Mitigating Factors:
====================
- While FrontPage Server Extensions installs by default with IIS,
Visual Studio RAD Deployment Support coordination is not
provided with FPSE by default on an initial installation of
IIS. Installation must be selected and approved by the user
in charge of the server using the IIS setup process. If a user
selects this sub-component during an initial installation, a
warning is raised stating that this should not be installed
on a production system. Users must actively acknowledge this
warning to complete the installation.
Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletin
http://www.microsoft.com/technet/security/bulletin/ms01-035.asp
for information on obtaining this patch.
Acknowledgment:
===============
- Nsfocus (http://www.nsfocus.com)
---------------------------------------------------------------------
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS
IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES,
EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT
CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER
INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF
BUSINESS
PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY
NOT
APPLY.
[End Microsoft Advisory]
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org