• Article

Security Bulletin

Microsoft Security Bulletin MS99-003 - Critical

Patch Available for IIS "Malformed FTP List Request" Vulnerability

Published: February 03, 1999 | Updated: March 10, 2003

Version: 2.0

Patch Availability Information Updated: March 10, 2003

Originally Posted: February 3, 1999

Summary

Microsoft has released a patch that eliminates a vulnerability in the Internet Information Server FTP service. This vulnerability could allow denial of service attacks against the server or, under certain conditions, could allow arbitrary code to be executed on the server.

A fully supported fix for this problem is available. As detailed below in What Customers Should Do, Microsoft recommends that customers who are at risk from this vulnerability apply the patch.

Issue

The FTP service in IIS has an unchecked buffer in a component that processes "list" commands. This results in a vulnerability that poses two threats to safe operation. The first is a denial of service threat; a malformed "list" request could overflow the buffer causing the server to crash. The second is more esoteric and would be far more difficult to exploit. A carefully-constructed "list" request could cause arbitrary code to execute on the server via a classic buffer overrun technique. Neither variant could be exploited accidentally.

It is noteworthy that the "list" command is only available to users after they have authenticated to the server. As a result, only users who are authorized to use the server would be able to mount such an attack, and their presence on the server could be logged if the owner of the site chose to do so. However, many sites provide guest accounts, and this could allow a malicious user to attack the server anonymously.

Microsoft has no reports of any customers being affected by this vulnerability. However, Microsoft is proactively releasing a patch that corrects the problem.

Affected Software Versions

The following software versions are affected:

  • Microsoft Internet Information Server 3.0 and 4.0

Vulnerability Identifier: CVE-1999-0349

What Microsoft is Doing

On February 3rd, Microsoft released a patch that fixes the problem identified above. This patch is available for download from the sites listed below.

Microsoft has sent this security bulletin to customers subscribing to the Microsoft Product Security Notification Service. See The Microsoft Product Security Notification Service for more information about this free customer service.

Microsoft has published the following Knowledge Base (KB) article on this issue:

Microsoft has posted hot fixes to address this problem. Please note that all of these patches are designed to be applied atop Windows NT 4.0 SP4.

  • Fix for X86 version of IIS 3.0:

    https:

  • Fix for Alpha version of IIS 3.0:

    </https:>https:

  • Fix for X86 version of IIS 4.0:

    </https:>https:

  • Fix for Alpha version of IIS 4.0:

    </https:>https:

What customers should do

Microsoft highly recommends that all affected customers download the patch to protect their computers. The complete URL for each affected software version is provided above in What Microsoft is Doing.

More Information

Please see the following references for more information related to this issue.

Acknowledgments

Microsoft wishes to acknowledge the eEye Digital Security Team for discovering this vulnerability.

Obtaining Support on this Issue

This is a supported patch. If you have problems installing this patch or require technical assistance with this patch, please contact Microsoft Technical Support. For information on contacting Microsoft Technical Support, please see </https:>https:.

Revisions

  • February 3, 1999: Bulletin Created
  • V2.0 (March 10, 2003): Introduced versioning and updated patch availability information

For additional security-related information about Microsoft products, please visit https://www.microsoft.com/technet/security

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Built at 2014-04-18T13:49:36Z-07:00 </https:>