[9840] in bugtraq
ISAPI Extension vulnerability allows to execute code as SYSTEM
daemon@ATHENA.MIT.EDU (Aleph One)
Mon Mar 8 15:27:38 1999
Date: Mon, 8 Mar 1999 12:54:56 -0800
Reply-To: Aleph One <aleph1@UNDERGROUND.ORG>
From: Aleph One <aleph1@UNDERGROUND.ORG>
To: BUGTRAQ@NETSPACE.ORG
--ZGiS0Q5IWpPtfppv
Content-Type: text/plain; charset=us-ascii
--ZGiS0Q5IWpPtfppv
Content-Type: message/rfc822
Content-Description: Forwarded message from Fabien Royer <fabienr@BELLATLANTIC.NET>
Received: (qmail 4091 invoked from network); 8 Mar 1999 20:35:44 -0000
Received: from dfw.nationwide.net (@198.175.15.10)
by underground.org with SMTP; 8 Mar 1999 20:35:44 -0000
Received: from VMS.DC.LSOFT.COM (vms.dc.lsoft.com [209.119.1.27])
by dfw.nationwide.net (8.9.0/8.9.0) with ESMTP id NAA18735
for <aleph1@NATIONWIDE.NET>; Mon, 8 Mar 1999 13:20:58 -0600 (CST)
Received: from peach (209.119.0.4) by VMS.DC.LSOFT.COM (LSMTP for OpenVMS v1.1a) with SMTP id <2.04CA0AD3@VMS.DC.LSOFT.COM>; Mon, 8 Mar 1999 14:18:37 -0500
Received: from LISTSERV.NTBUGTRAQ.COM by LISTSERV.NTBUGTRAQ.COM
(LISTSERV-TCP/IP release 1.8c) with spool id 64303 for
NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM; Mon, 8 Mar 1999 14:22:38 -0500
Approved-By: Russ.Cooper@RC.ON.CA
Received: from 199.45.39.157 by PEACH.EASE.LSOFT.COM (SMTPL release 1.0d) with
TCP; Mon, 8 Mar 1999 11:29:40 -0500
Received: from teddy (client-151-197-118-94.bellatlantic.net [151.197.118.94])
by smtp-out2.bellatlantic.net (8.9.1/8.9.1) with SMTP id LAA18717 for
<NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM>; Mon, 8 Mar 1999 11:30:05 -0500
(EST)
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
Importance: Normal
X-Mimeole: Produced By Microsoft MimeOLE V4.72.3155.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-ID: <001201be6980$9aaa1240$0b0a0a0a@teddy.rippletech.com>
Date: Mon, 8 Mar 1999 11:27:48 -0500
Reply-To: Fabien Royer <fabienr@BELLATLANTIC.NET>
Sender: Windows NT BugTraq Mailing List <NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM>
From: Fabien Royer <fabienr@BELLATLANTIC.NET>
Subject: ISAPI Extension vulnerability allows to execute code as SYSTEM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
There's a vulnerability in IIS (and other WEB servers executing as SYSTEM)
that allows to execute an ISAPI extension in the security context of the
server itself instead of the security context of IUSR_WHATEVER. How is this
possible: when the server loads an ISAPI extension the first time, it calls
GetExtensionVersion(). During the call to this function, an attacker can
execute any code as SYSTEM. This is a problem if you're an ISP doing hosting
with web servers offering ISAPI support (IIS, Apache 1.3.4, etc. ) because
any user allowed to place a "CGI" on the server can take over. Of course,
this problem is not limited to ISPs.
Fabien.
--ZGiS0Q5IWpPtfppv--
