OSVDB ID: 768 Title: Microsoft IIS ASP Chunked Encoding Heap Overflow |
Info |
|
|
Dates |
||||
|
|
Description |
A remote overflow exists in IIS Active Server Pages (ASP). IIS fails to allocate the proper size buffer resulting in a heap-based overflow. With a specially crafted request, an attacker can cause either a DoS or the execution of arbitrary code, resulting in a loss of confidentiality, integrity, and/or availability. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability Exploit: Exploit Public, Exploit Commercial Disclosure: OSVDB Verified |
Solution |
Install Patch Q319733, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workarounds: 1. Disable ASP - Version 1.0 of the IIS Lockdown Tool disables ASP by default, and version 2.1 disables ASP if "Static Web Server" is selected. 2. The URLScan tool can be configured to block chunked encoding requests. |
Products |
|
Credit |
Unknown or Incomplete |