OSVDB ID: 27152

Title: Microsoft Windows IIS ASP Page Processing Overflow

Info

Disclosure
Jul 11, 2006

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Jul 11, 2006

Description

 A remote overflow exists in Windows. Internet Information Services (IIS) fails to validate Active Server Pages (ASP) files resulting in a buffer overflow. With a specially crafted ASP file, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Unknown
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Web Related

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

Windows

 2000 SP4
XP SP1
XP SP2
XP Professional x64 Edition

Windows Server

 2003
2003 SP1
2003 for Itanium
2003 SP1 for Itanium
2003 x64 Edition

References

Credit
  • Brett Moore - brett.mooresecurity-assessment.com - Security Assessment


Direct URL: http://osvdb.org/27152