[NT] IIS Executes Files by Default Whenever They Reside Under an ".asp" Directory

From: SecuriTeam (support_at_securiteam.com)
Date: 07/31/03

  • Next message: SecuriTeam: "[EXPL] Half-Life Clients Buffer Overflow Vulnerability Exploit Code" 
    To: list@securiteam.com
Date: 31 Jul 2003 14:45:24 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Get Thawte's New Step-by-Step SSL Guide for Apache.
    In this guide you will find out how to test, purchase,
    install and use a Thawte Digital Certificate on you Apache web server.
    Throughout, best practices for set-up are highlighted to help you
    ensure efficient ongoing management of your encryption keys and digital
    certificates. Get you copy of this new guide now:
    http://ad.doubleclick.net/clk;5903117;8265118;i

    - - - - - - - - -

      IIS Executes Files by Default Whenever They Reside Under an ".asp"
    Directory
    ------------------------------------------------------------------------

    SUMMARY

    When a directory is named like an ASP file, the ASP engine will try parse
    any file that resides under it, no matter what extension that file has.

    This may be dangerous when users are able to create directories and upload
    images into them. As a malicious user, could upload an ASP script with the
    extension of an image and then run it.

    DETAILS

    Exploit:
    Create the directory "test.asp" in your web root and place the following
    file in it:
     -- exploit.gif ------------------------------------
     Hello world, I'm an image!
     ---------------------------------------------------

    Open http://localhost/test.asp/exploit.gif in your browser and you should
    read the message.
     
    Live sample:
     <http://badwebmasters.net/advisory/013/test.asp/exploit.gif>
    http://badwebmasters.net/advisory/013/test.asp/exploit.gif

    Vendor status:
    Microsoft has been contacted on 16 June, via the web form, about this bug.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:badwebmasters@online.de> ben
    moeckel.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Half-Life Clients Buffer Overflow Vulnerability Exploit Code"

    Relevant Pages