A remote overflow exists in the Internet Services Application Programming Interface (ISAPI) ISM.DLL extensions used in HTR scripting. With a specially crafted URL, an attacker can cause either a DoS or the execution of arbitrary code, resulting in a loss of confidentiality, integrity, and/or availability.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity,
Loss of Availability
Solution:
Workaround,
Patch / RCS
Exploit:
Exploit Public
Disclosure:
OSVDB Verified,
Vendor Verified
Technical
Arbitrary code will be executed with the privileges of the IWAM_computername account for default installations of IIS 5.0 and 5.1.
If the vulnerability is exploited to cause a DoS, the IIS service must be restarted manually on for version 4.0, while the service would automatically restart in IIS 5.0.
Solution
Install Patch Q319733, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workarounds:
1. Disable HTR ISAPI extension - All versions of the IIS Lockdown Tool disable HTR by default.
2. The URLScan tool can be used to prevent code execution (even if HTR is enabled), but not the DoS.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
eeye.com -
eEye Digital Security
