From owner-csa@sprocket.nosc.MIL Sat Feb 27 14:43:10 1999
From: owner-csa@sprocket.nosc.MIL
To: CSA-List@sprocket.nosc.MIL
Date: Tue, 16 Feb 1999 07:09:32 -0500
Subject: IAVA 1999-0004 Microsoft IIS "Malformed FTP List Request"

Vulnerability 
Sender: owner-csa
Precedence: bulk

Automated Systems Security Incident Support Team (ASSIST)

Advisory  1999-0004

Release date: 11 Feb 1999

TOPIC: Microsoft IIS "Malformed FTP List Request" Vulnerability 

DESCRIPTION: Microsoft's IIS FTP server has a vulnerability that 
is remotely executable.  This vulnerability is due to a programming 
flaw that allows an intruder to execute arbitrary code on a remote
system.   

PLATFORM:  Microsoft Operating systems with IIS version 3 & 4 
installed 

IMPACT: An intruder could gain unrestricted access to a system as 
a result of this vulnerability.  While Microsoft lists this vulnerability
as primarily a denial of service attack, ASSIST believes the attack 
could likely result in unauthorized access based on past exploits.   

SOLUTION: Apply the patches as described in the attached bulletin 


-------------------- Attached Bulletin -------------------


Microsoft Security Bulletin (MS99-003)
--------------------------------------

Patch Available for IIS "Malformed FTP List Request" Vulnerability

Originally Posted: February 3, 1999

Summary
=======
Microsoft has released a patch that eliminates a vulnerability in the
Internet Information Server (r) FTP service. This vulnerability could allow
denial of service attacks against the server or, under certain conditions,
could allow arbitrary code to be executed on the server.

A fully supported fix for this problem is available. As detailed below in
What Customers Should Do, Microsoft recommends that customers who are at
risk from this vulnerability apply the patch.

Issue
=====
The FTP service in IIS has an unchecked buffer in a component that processes
"list" commands. This results in a vulnerability that poses two threats to
safe operation. The first is a denial of service threat; a malformed "list"
request could overflow the buffer causing the server to crash. The second is
more esoteric and would be far more difficult to exploit. A
carefully-constructed "list" request could cause arbitrary code to execute
on the server via a classic buffer overrun technique. Neither variant could
be exploited accidentally.

It is noteworthy that the "list" command is only available to users after
they have authenticated to the server. As a result, only users who are
authorized to use the server would be able to mount such an attack, and
their presence on the server could be logged if the owner of the site chose
to do so. However, many sites provide guest accounts, and this could allow a
malicious user to attack the server anonymously.

Microsoft has no reports of any customers being affected by this
vulnerability. However, Microsoft is proactively releasing a patch that
corrects the problem.

Affected Software Versions
==========================
The following software versions are affected:
 - Microsoft Internet Information Server 3.0 and 4.0

What Microsoft is Doing
=======================
On February 3rd, Microsoft released a patch that fixes the problem
identified above. This patch is available for download from the sites listed
below.

Microsoft has sent this security bulletin to customers subscribing
to the Microsoft Product Security Notification Service (see
http://www.microsoft.com/security/services/bulletin.asp for
more information about this free customer service).

Microsoft has published the following Knowledge Base (KB) article on this
issue:
 - Microsoft Knowledge Base (KB) article Q188348,
   Specially-Malformed FTP Requests Can Create Denial of Service
   http://support.microsoft.com/support/kb/articles/q188/3/48.asp
   (Note: It might take 24 hours from the original posting of this
   bulletin for the KB article to be visible in the Web-based
   Knowledge Base.)

Microsoft has posted hot fixes to address this problem. Please note that all
of these patches are designed to be applied atop Windows NT (r) 4.0 SP4.
The URLs below have been word-wrapped for readability.
 - Fix for X86 version of IIS 3.0:
   ftp://ftp.microsoft.com/bussys/iis/iis-public/
   fixes/usa/security/ftpls-fix/ftpls3i.exe
 - Fix for Alpha version of IIS 3.0:
   ftp://ftp.microsoft.com/bussys/iis/iis-public/
   fixes/usa/security/ftpls-fix/ftpls3a.exe
 - Fix for X86 version of IIS 4.0:
   ftp://ftp.microsoft.com/bussys/iis/iis-public/
   fixes/usa/security/ftpls-fix/ftpls4i.exe
 - Fix for Alpha version of IIS 4.0:
   ftp://ftp.microsoft.com/bussys/iis/iis-public/
   fixes/usa/security/ftpls-fix/ftpls4a.exe

What customers should do
========================
Microsoft highly recommends that all affected customers download the patch
to protect their computers. The complete URL for each affected software
version is provided above in What Microsoft is Doing.

More Information
================
Please see the following references for more information related to this
issue.
 - Microsoft Security Bulletin MS99-003,
   Patch Available for IIS "Malformed FTP List Request"
   Vulnerability (the Web-posted version of this bulletin),
   http://www.microsoft.com/security/bulletins/ms99-003.asp.
 - Microsoft Knowledge Base (KB) article Q188348,
   Specially-Malformed FTP Requests Can Create Denial of Service,
   http://support.microsoft.com/support/kb/articles/q188/3/48.asp
   (Note: It might take 24 hours from the original posting of this
   bulletin for the KB article to be visible in the Web-based
   Knowledge Base.)

Acknowledgements
================
Microsoft wishes to acknowledge the eEye Digital Security Team for
discovering this vulnerability.

Obtaining Support on this Issue
===============================
This is a supported patch. If you have problems installing this
patch or require technical assistance with this patch, please
contact Microsoft Technical Support. For information on
contacting Microsoft Technical Support, please see
http://support.microsoft.com/support/contact/default.asp.

Revisions
=========
 - February 3, 1999: Bulletin Created

For additional security-related information about Microsoft products,
please visit http://www.microsoft.com/security


----------------------------------------------------------------------------
----

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS"
WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER
EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS
SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN
IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR
LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE
FOREGOING LIMITATION MAY NOT APPLY.

(c) 1999 Microsoft Corporation. All rights reserved. Terms of Use.

   *******************************************************************
You have received  this e-mail bulletin as a result  of your registration
to  the   Microsoft  Product  Security  Notification   Service.  You  may
unsubscribe from this e-mail notification  service at any time by sending
an  e-mail  to  MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
The subject line and message body are not used in processing the request,
and can be anything you like.

For  more  information on  the  Microsoft  Security Notification  Service
please    visit    http://www.microsoft.com/security/bulletin.htm.    For
security-related information  about Microsoft products, please  visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.


___________________________ 
ASSIST CONTACT INFORMATION:

NIPRNET E-mail: assist@assist.mil 
SIPRNET E-mail: assist@assist.disa.smil.mil
Phone:  (800)-357-4231 (DSN 327-4700) 24 hour hotline 
Fax:    (703) 607-4735 (DSN 327-4735) Unclassified

ASSIST Bulletins, tools and other security related information are
available from:
    http://www.assist.mil/ 
    http://www.assist.disa.smil.mil
    ftp://ftp.assist.mil/

____ 
OTHER DoD CERT CONTACT INFORMATION:  
Air Force CERT Phone: (800) 854-0187 
Air Force CERT Email: afcert@afcert.csap.af.mil

Navy CIRT Phone: (800) 628-8893 
Navy CIRT Email: navcirt@fiwc.navy.mil

Army CERT Phone: (888) 203-6332 
Army CERT Email: acert@vulcan.belvoir.army.mil


Back issues of ASSIST bulletins, and other security related
information, through anonymous  FTP from ftp.assist.mil (IP address
199.211.123.12).  Note:  ftp.assist.mil will only accept anonymous FTP
connections from  NIPRNET addresses that are registered with the NIC
or DNS. If your system is not registered, you must provide your
NIPRNET IP address to ASSIST before access can be provided.

ASSIST uses Pretty Good Privacy (PGP) as the digital signature
mechanism for bulletins.   PGP incorporates the RSAREF(tm)
Cryptographic Toolkit under license from RSA Data Security, Inc.  A
copy of that license is available via anonymous FTP from
net-dist.mit.edu (IP 18.72.0.3) in the file /pub/PGP/rsalicen.txt.  In
accordance with the terms of that license,  PGP may be used for
non-commercial purposes only.  Instructions for downloading the PGP
software can also be obtained from net-dist.mit.edu in the
pub/PGP/README file.  PGP and RSAREF may be subject to the export
control laws of the United States of America as implemented by the
United States

Department of State Office of Defense Trade Controls.  The PGP
signature information will be attached to the end of ASSIST bulletins.

Reference herein to any specific commercial product, process, or
service by trade name, trademark manufacturer, or otherwise, does not
constitute or imply its endorsement, recommendation, or favoring by
ASSIST.  The views and opinions of authors expressed herein shall not
be used for advertising or product endorsement purposes.