[NT] Vulnerability in Microsoft Internet Information Services Allows Code Execution (MS07-041)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Vulnerability in Microsoft Internet Information Services Allows Code
Execution (MS07-041)
------------------------------------------------------------------------

SUMMARY

This important security update resolves a privately reported
vulnerability. This vulnerability could allow remote code execution if an
attacker sent specially crafted URL requests to a Web page hosted by
Internet Information Services (IIS) 5.1 on Windows XP Professional Service
Pack 2. IIS 5.1 is not part of a default install of Windows XP
Professional Service Pack 2. An attacker who successfully exploited this
vulnerability could take complete control of the affected system.

DETAILS

Vulnerable Systems:
* Windows XP Professional Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=fccbfe90-f838-47df-8310-352e2fb47132> Microsoft Internet Information Services (IIS) 5.1

Immune Systems:
* Windows 2000 Service Pack 4
* Windows XP Home Service Pack 2
* Windows XP Professional x64 Edition and Windows XP Professional x64
Edition Service Pack 2
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack
2
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition
Service Pack 2
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows
Server 2003 with SP2 for Itanium-based Systems
* Windows Vista
* Windows Vista x64 Edition

There is a remote code execution vulnerability in Internet Information
Services (IIS) 5.1 on Windows XP Professional Service Pack 2 that could
allow an attacker who successfully exploited this vulnerability to take
complete control of the affected system. An attacker could exploit the
vulnerability by sending specially crafted URL requests to a Web page
hosted by Internet Information Services.

Workarounds for IIS Memory Request Vulnerability - CVE-2005-4360
Microsoft has tested the following workarounds. Although these workarounds
will not correct the underlying vulnerability, they help block known
attack vectors. When a workaround reduces functionality, it is identified
in the following section. It is recommended that customers use versions of
IIS included in server editions of Windows and use the version of IIS
included in Windows XP Professional Service Pack 2 for development and
testing of Web sites and Web pages.

* Use URLScan 2.5
The installation of URLScan helps protect the affected system from
attempts to exploit this vulnerability.

1. Install URLScan, using the default URLScan.ini settings.

2. Restart the IISAdmin and WWW Publishing services for the changes to
take effect.

* To help protect from network-based attempts to exploit this
vulnerability, block access to port 80 (TCP) using:
* Windows Firewall.
* Internet Protocol security (IPSec). Detailed information about IPSec
and about how to apply filters is available in Microsoft Knowledge Base
Article <http://support.microsoft.com/kb/313190> 313190 and Microsoft
Knowledge Base Article <http://support.microsoft.com/kb/813878> 813878.

Additional ports where Web content is hosted by IIS should also be
blocked.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4360>
CVE-2005-4360

ADDITIONAL INFORMATION

The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms07-041.mspx>

http://www.microsoft.com/technet/security/bulletin/ms07-041.mspx

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.