IIS 5.0 Digest authentication does not process username strings properly

From: Jannie Hanekom (jannie.hanekom_at_OPENDEV.NET)
Date: 05/08/03

  • Next message: Qazi Ahmed: "Multiple Vulnerabilities found in Microsoft .Net Passport Services" 
    Date:         Thu, 8 May 2003 03:57:31 +0100
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    IIS 5.0 Digest authentication does not process username strings properly

    Severity: Minimal?

    We have discovered a flaw in the way Digest Authentication processes the
    username portion of authentication requests. Sending a
    "DOMAIN\username" in stead of just a username for a resource protected
    with Digest Authentication results in IIS passing the request on to the
    OS as DOMAIN\\username (this is the value recorded in the IIS log files
    - Windows event logs records a failed logon attempt with domain of
    "DOMAIN" and username of "\username").

    The result is that IIS allows arbitrary users to send malformed account
    names to the operating system. We do not know the exact impact of this,
    but have noticed odd behavior when sending a null username (DOMAIN\) or
    special characters (more backslashes or other characters) in the browser
    request. With a '\' as a username, Windows 2000 responds as if the
    account exists, but that the password supplied is invalid.

    The bug appears to be that the Digest Auth filter does not handle the
    string that the browser sends to it properly (network traces reveal the
    browser sends "DOMAIN\\USERNAME" - probably a C-style string with a
    double-backslash to indicate it's not an escape sequence).

    Contacting PSS has yielded varying responses from "it should work"
    initially to strong denials that this (faulty) behavior is a bug at all.

    Initially we were trying to get Digest Authentication working with
    accounts in trusted domains, but now we are worried that this bug may
    allow for potential security vulnerabilities.

    Does anyone have any input on this matter?

    Regards
    Jan Hanekom
    Open Developers

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Delivery co-sponsored by IP3 Inc.
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    SECURITY QUESTIONS? We've got answers...Apply for a scholarship and become
    TICSA certified.

    Do not miss your opportunity to discover solutions to what our participants
    have identified as their top 5 IT Security Challenges. You will return to
    work better prepared to put into place an effective security strategy
    utilizing the latest security tools, bookmarks and URL's.

    <http://www.ip3seminars.com>

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

  • Next message: Qazi Ahmed: "Multiple Vulnerabilities found in Microsoft .Net Passport Services"

    Relevant Pages

    • Re: Authentication problem
      ... My first suggestion would be to see if Administrator can log in to the site. ... You would need to exclude IIS box from your Domain security policy. ... > - Same problem no matter what username or client PC used ...
      (microsoft.public.inetserver.iis.security)
    • Re: Win 2K3, IIS6.0 Config
      ... >> in IIS as required. ... >> enter a username or password each time they visit the ... >not prompting for intranet use. ... Internet Options> Security ...
      (microsoft.public.inetserver.iis.security)
    • Problem with Digest Authentication
      ... I have activate Digest Authentication on my Web. ... Now I have the problem that when I access the Webside IIS ask me ... I the index.html have one picture I have to give my username ...
      (microsoft.public.inetserver.iis)
    • Re: WSE 3.0, usernameOverTransportSecurity, custom Token Manager w/ securityTokenManager,
      ... Microsoft.Web.Services3.Security.Security security) ... throw new Exception("The username token is not present in the ... I've added the web service call directly to my Data binding method ... protected override string AuthenticateToken(UsernameToken ...
      (microsoft.public.dotnet.framework.webservices.enhancements)
    • Re: WSE 3.0, usernameOverTransportSecurity, custom Token Manager w/ securityTokenManager,
      ... Microsoft.Web.Services3.Security.Security security) ... This assertion is only valid to see whether you are receiving the username ... I've added the web service call directly to my Data binding method ... protected override string AuthenticateToken(UsernameToken token) ...
      (microsoft.public.dotnet.framework.webservices.enhancements)