Vulnerability Note VU#203126

Microsoft IIS contains vulnerability in NNTP service

Overview

A vulnerability in the NNTP component of Microsoft IIS may allow a remote attacker to compromise the affected system.

I. Description

The Network News Transport Protocol (NNTP) is a protocol for the distribution, inquiry, retrieval, and posting of news articles over a network. Microsoft's Internet Information Services (IIS) provides support for a number of protocols, including NNTP. In addition to the original protocol specification in IETF RFC977, a number of standard extensions to NNTP are specified in RFC2980. One of these, the XPAT command, is used to retrieve specific headers from specific articles, based on pattern matching on the contents of the header. Several related flaws exist in the way the NNTP component handles the parsing and translation of user-supplied search patterns. These flaws result in a vulnerability that could be exploited by an attacker with the ability to send a specially crafted message to the affected server.

II. Impact

A remote unauthenticated attacker may be able to execute code of their choosing with administrative privileges on the affected system.

III. Solution

Apply a patch from the vendor

Microsoft has published Microsoft Security Bulletin MS04-036 in response to this issue. Users are strongly encouraged to review this bulletin and apply the patches it refers to.

Workarounds

In addition to the patches referenced above, Microsoft has published workarounds for this issue. Users who are unable to apply the patches are strongly encouraged to implement these workarounds as appropriate.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	13-Oct-2004

References

http://www.microsoft.com/technet/security/bulletin/MS04-036.mspx
http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10

Credit

Thanks to Lucas Lavarello and Juliano Rizzo of Core Security Technologies for reporting this issue.

This document was written by Chad R Dougherty based on information provided by Microsoft and Core Security Technologies.

Other Information

Date Public:	2004-10-12
Date First Published:	2004-10-21
Date Last Updated:	2004-10-22
CERT Advisory:
CVE-ID(s):	CAN-2004-0574
NVD-ID(s):	CAN-2004-0574
US-CERT Technical Alerts:
Metric:	30.06
Document Revision:	12

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader