Microsoft Security Bulletin MS00-019 - Critical

Published: March 30, 2000

Version: 1.0

Originally Posted: March 30, 2000

Summary

Microsoft has released a patch that eliminates a security vulnerability in Microsoft® Internet Information Server and products based on it. Under certain fairly unusual conditions, the vulnerability could cause a web server to send the source code of .ASP and other files to a visiting user.

Frequently asked questions regarding this vulnerability and the patch can be found at https://www.microsoft.com/technet/security/bulletin/fq00-019.mspx

General Information

Issue

If a virtual directory on an IIS server is mapped to a UNC share, and a request for a file in the directory contains one of several particular characters at the end, the expected ISAPI extension processing may not occur. The result is that the source code of the file would be sent to the browser.

There are significant restrictions that would increase the difficulty of exploiting this vulnerability:

By design, virtual directories hide the actual location of files. Under most circumstances, there would be no way for an attacker to determine which files on a server actually reside on a UNC share.
Many browsers will "correct" requests that contain the trailing characters at issue here, by either removing the characters or changing them.
If recommended security practices are followed, .ASP and other files that require server-side processing will not contain any sensitive information to compromise.

Affected Software Versions

Microsoft Internet Information Server 4.0 and 5.0
Microsoft Proxy Server 2.0
Microsoft Site Server and Site Server, Commerce Edition 3.0
Microsoft Commercial Internet System 2.0 and 2.5

Vulnerability Identifier: CVE-2000-0246

Patch Availability

Internet Information Server 4.0
Intel: https://www.microsoft.com/download/details.aspx?displaylang=en&FamilyID;=C5BBC017-52CE-4F12-B803-F8D72B87C7A2

Alpha: https://www.microsoft.com/download/details.aspx?displaylang=en&FamilyID;=63D04873-BB7C-4659-BAB5-993CD288F615
Internet Information Server 5.0
https://www.microsoft.com/download/details.aspx?FamilyId=7A91D29D-375C-49D9-A909-47C7C85D9065&displaylang;=en

Note: Proxy Server, Site Server, Site Server Commerce Edition and Microsoft Commercial Internet System run atop IIS. Customers using these products should apply the patch appropriate for the version of IIS they are running.

Note: Additional security patches are available at the Microsoft Download Center

More Information

Please see the following references for more information related to this issue.

Frequently Asked Questions: Microsoft Security Bulletin MS00-019
Microsoft Knowledge Base (KB) article 249599, Virtual Directory Mapped to UNC Returns Server-Side Script Code When URL Contains Additional Characters at the End of the Request
Microsoft TechNet Security web site.

Obtaining Support on this Issue

This is a fully supported patch. Information on contacting Microsoft Technical Support is available at https:.

Acknowledgments

Microsoft thanks Adam Coyne (adam@coyne.nu) for reporting this problem to us and working with us to protect customers.

Revisions

March 30, 2000: Bulletin Created.

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Built at 2014-04-18T13:49:36Z-07:00 </https:>