Info

Disclosure

May 01, 2001

Discovery

Unknown

Dates

Exploit

May 07, 2001

Solution

May 01, 2001

Description

Microsoft IIS contains a flaw that allows a remote attacker to execute arbitrary code on a vulnerable server. The issue is due to the .printer ISAPI (Internet Services Application Programming Interface) Internet Printing Protocol (IPP) filter, handled by \WINNT\System32\msw3prt.dll, containing a buffer overflow. When a buffer of 420 bytes is sent within the HTTP Host: header of a .printer ISAPI request, the buffer is overflowed allowing the attacker to overwrite the EIP register and execute arbitrary code with SYSTEM access.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Web Related

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch (MS01-023) to address this vulnerability.

Products

Microsoft Corporation

IIS

5.0

References

CVE ID: 2001-0241 (see also: NVD)
Milw0rm: 266 268
Exploit Database: 266 268
Bugtraq ID: 2674
Metasploit ID: 3323
CERT VU: 516648
ISS X-Force ID: 6485
CERT: CA-2001-10
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2001-05/0006.html
http://archives.neohapsis.com/archives/bugtraq/2001-05/0024.html
http://archives.neohapsis.com/archives/bugtraq/2001-05/0088.html
Generic Exploit URL: http://immunitysec.com
http://www.saintcorporation.com/cgi-bin/exploit_info/iis_printer_isapi
Other Advisory URL: http://research.eeye.com/html/advisories/published/AD20010501.html
http://www.eeye.com/html/Research/Advisories/AD20010501.html [ Link is 404 ]
http://www.iss.net/xforce/alerts/id/advise75
http://www.nipc.gov/warnings/advisories/2001/01-011.htm
CIAC Advisory: l-078
Microsoft Security Bulletin: MS01-023
Keyword: msw3prt.dll NULL.printer
Microsoft Knowledge Base Article: Q296576

Credit

Riley Hassell - rileyeeye.com - eEye Digital Security

Direct URL: http://osvdb.org/3323