OSVDB ID: 3301 Title: Microsoft IIS ASP Chunked Encoding Variant Heap Overflow |
Info |
|
|
Dates |
||||
|
|
Description |
A remote overflow exists in IIS Active Server Pages (ASP). IIS fails to allocate the proper size buffer resulting in a heap-based overflow. With a specially crafted request, an attacker can cause either a DoS or execution of arbitrary code, resulting in a loss of confidentiality, integrity, and/or availability. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Install Patch Q319733, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): 1. Disable ASP - Version 1.0 of the IIS Lockdown Tool disables ASP by default, and version 2.1 disables ASP if "Static Web Server" is selected. 2. The URLScan tool can be used to prevent chunked encoding requests. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |