Index Server Vulnerable To Information Stealing


Reported October 28, 2000 by Georgi Guninski

VERSIONS AFFECTED
  • Microsoft Internet Information Server 5.0
  • Microsoft Index Server

DESCRIPTION

Georgi Guninski has discovered a security issue that he believes in present in Internet Information Server 5.0.  By using specifically designed URLs a malicious attacker could retrieve specific content.  One such scenario could lead to cookie stealing.

DEMONSTRATION

The following URL could be used in a link or script and will execute in javascript under iis5server but is defined by the user.

http://iis5server/null.htw?CiWebHitsFile=/default.htm&CiRestriction="

The .htm file specified must exist in order for this to work.

VENDOR RESPONSE

Microsoft has confirmed that this vulnerability exists but says that the problem is present in Microsoft Index Server not Internet Information Server.  Microsoft is currently testing a patch and will release a security bulletin and patch soon.

CREDIT
Discovered by
Georgi Guninski

 
TAGS: Security
Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish