Vulnerability Note VU#203126
Microsoft IIS contains vulnerability in NNTP service
A vulnerability in the NNTP component of Microsoft IIS may allow a remote attacker to compromise the affected system.
The Network News Transport Protocol (NNTP) is a protocol for the distribution, inquiry, retrieval, and posting of news articles over a network. Microsoft's Internet Information Services (IIS) provides support for a number of protocols, including NNTP. In addition to the original protocol specification in IETF RFC977, a number of standard extensions to NNTP are specified in RFC2980. One of these, the XPAT command, is used to retrieve specific headers from specific articles, based on pattern matching on the contents of the header. Several related flaws exist in the way the NNTP component handles the parsing and translation of user-supplied search patterns. These flaws result in a vulnerability that could be exploited by an attacker with the ability to send a specially crafted message to the affected server.
A remote unauthenticated attacker may be able to execute code of their choosing with administrative privileges on the affected system.
Apply a patch from the vendor
Microsoft has published Microsoft Security Bulletin MS04-036 in response to this issue. Users are strongly encouraged to review this bulletin and apply the patches it refers to.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||-||13 Oct 2004|
CVSS Metrics (Learn More)
Thanks to Lucas Lavarello and Juliano Rizzo of Core Security Technologies for reporting this issue.
This document was written by Chad R Dougherty based on information provided by Microsoft and Core Security Technologies.
- CVE IDs: CAN-2004-0574
- Date Public: 12 Oct 2004
- Date First Published: 21 Oct 2004
- Date Last Updated: 22 Oct 2004
- Severity Metric: 30.06
- Document Revision: 12
If you have feedback, comments, or additional information about this vulnerability, please send us email.