Vulnerability Note VU#544555

Microsoft Internet Information Server 4.0 (IIS) vulnerable to DoS when URL redirecting is enabled

Overview

A vulnerability in IIS 4.0 may permit intruders to crash vulnerable IIS servers with URL redirection enabled.

I. Description

A vulnerability in Microsoft IIS 4.0 allows an attacker to crash IIS 4.0 servers if they are configured to use URL redirection. URL redirection is not used by default. This vulnerability is exercised by the Code Red worm, but is distinct from the vulnerability that allows the worm to compromise systems. For more information, please see

http://www.microsoft.com/technet/itsolutions/security/tools/redthree.asp?frame=true

No patch is available at this time. Due to the large numbers of systems still infected with Code Red as of this writing, it is likely that systems running IIS 4.0 with redirection enabled will have difficulty maintaining normal operation until and unless URL redirection is disabled, or until a patch is available.

II. Impact

Intruders can crash vulnerable IIS 4.0 systems. IIS 5.0 is not affected.

III. Solution

No patch is currently available.

Until a patch is available disable URL redirection on your system.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft	Vulnerable	14-Aug-2001

References

http://www.microsoft.com/technet/itsolutions/security/tools/redthree.asp?frame=true
http://www.kb.cert.org/vuls/id/952336

Credit

Our thanks to Microsoft for the information contained on their web site.

This document was written by Shawn V. Hernan.

Other Information

Date Public:	2001-08-13
Date First Published:	2001-08-14
Date Last Updated:	2001-08-14
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	22.50
Document Revision:	5

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader