Recognize-Security

Posted by Trancer on Aug 31 2009

Kingcope have done it again, fully disclosing a serious 0day vulnerability in a high profile Microsoft product – A remotely exploitable stack-based buffer overflow vulnerability in Microsoft IIS FTP server.
Vulnerable versions are Microsoft IIS 5.0 (Windows 2000) and IIS 6.0 (Windows 2003) but due to stack cookie protection (/GS), on IIS 6.0 this vulnerability is unexploitable for code execution, only for denial-of-service.
The original advisory by Kingcope can be found on Full-Disclosure and the exploit can also be found on milw0rm and exploit-database #9541.

Mati Aharoni (muts) posted on the BackTrack blog a better version of the exploit. His exploit use the password value to store the payload which allows to store a larger payload – Microsoft IIS FTP 5.0 Remote SYSTEM Exploit.

Also, Xavier Mertens posted an Nmap script to scan potentially vulnerable hosts. The script check if the remote host runs Microsoft ftpd, check if anonymous login are allowed and if the MKDIR command is enabled (all the parameters needed for exploitation) – Detecting Vulnerable IIS-FTP Hosts Using Nmap.

I’ll keep this post up to date with interesting resources and further details about this vulnerability.

Updates:

>> HD Moore added a coverage for this vulnerability the Metasploit SVN tree – microsoft_ftpd_nlst.rb.

>> Kingcope also posted a Denial-of-Service (Stack Exhaustion) exploit which affects IIS 5.0, 5.1 and 6.0 FTP server on milw0rm and exploit-database #9587.

>> Thierry Zoller wrote an overview of the vulnerability on G-SEC blog – IIS 5 & IIS 6 FTP vulnerability – information and tools.

>> Microsoft issued a security advisory (975191) for this vulnerability and posted an informative post on the SRD blog – New vulnerability in IIS5 and IIS6.

>> Microsoft patched this vulnerability – MS09-053.

Categories: Vulnerabilities

1 Comments | Comments RSS | TrackBack URL

---