Vulnerability Note VU#516648

Microsoft Windows 2000/Internet Information Server (IIS) 5.0 Internet Printing Protocol (IPP) ISAPI contains buffer overflow (MS01-023)

Overview

A vulnerability exists in Microsoft IIS 5.0 running on Windows 2000 that allows a remote intruder to run arbitrary code on the victim machine.

I. Description

Windows 2000 includes support for the Internet Printing Protocol (IPP) via an ISAPI extension. According to Microsoft, this extension is installed by default on all Windows 2000 systems, but is only accesible through IIS 5.0. The IPP ISAPI extension contains a buffer overflow that could be used by an attacker to execute arbitrary code in the Local System security context, essentially giving the attacker compete control of the system. For more information, see MS01-023 and the eEye Digital Security bulletin.

II. Impact

Remote intruders can execute arbitrary code in the Local System security context.

III. Solution

Install the patch as described in http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29321

One workaround is to remove the ISAPI Internet Printing extension by following these steps:

Open Internet Services Manager
Right-click the web server and Select "Properties" from the Context menu
Select "Master Properties"
In the WWW service->Edit->HomeDirectory menu, Select "Configuration"
Delete the entry for ".printer"

Systems Affected

No Information Available

References

http://www.microsoft.com/technet/security/bulletin/MS01-023.asp
http://www.eeye.com/html/Research/Advisories/AD20010501.html
http://www.microsoft.com/technet/security/iis5chk.asp
http://www.microsoft.com/technet/security/tools.asp
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=29321
http://www.securityfocus.com/bid/2674

Credit

This document was written by Shawn V Hernan.

Other Information

Date Public	05/01/2001
Date First Published	05/02/2001 12:56:14 PM
Date Last Updated	06/25/2001
CERT Advisory	CA-2001-10
CVE Name	CAN-2001-0241
Metric	54.00
Document Revision	13

If you have feedback, comments, or additional information about this vulnerability, please send us email.