Microsoft IIS - Possible authentication flaw?

From: root@synopse.homeip.net
Date: 05/27/02 

Date: 27 May 2002 20:37:03 -0000
From: <root@synopse.homeip.net>
To: vuln-dev@securityfocus.com
('binary' encoding is not supported, stored as-is)

Greetings,
I was playing around with Microsoft IIS 5.1 when I noticed
something very weird. If you go to a directory which has
basic authentication enabled, and enter the string: %1p as
the login, it will put this into the event logs under the
system subsection:

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 100
Date: 14/05/2002
Time: 2:21:35 PM
User: N/A
Computer: WINDOWS
Description:
The server was unable to logon the Windows NT account
'%
1ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp
pppppppppppppppppppppppppppppppppppppppp' due to the
following error: %2 The data is the error code.

For additional information specific to this message please
visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2e 05 00 00 ....

(Note: The p after %1 can be any character it seems. I just
used %1p as my
example.) 

---

If you enter the string: %2 as the login, it will also put 
this into the event logs under the system sub section:

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 100
Date:  14/05/2002
Time:  2:24:20 PM
User:  N/A
Computer: WINDOWS
Description:
The server was unable to logon the Windows NT 
account 'Logon failure: unknown user name or bad 
password. ' due to the following error: Logon
failure: unknown user name or bad password.  The data is 
the error code.

For additional information specific to this message please 
visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2e 05 00 00               ....

--

If you repeat %2, or %1p it will produce longer entries in 
the event logs, depending on how many times you wish to 
repeat it. I've been playing with this for a while now, and 
it only appears that %2 and %1 (followed by a character) 
will cause these weird entries in the event logs. I tested 
this on Windows XP Pro with all updates and patches, 
running IIS 5.1.

Georgi Guninski confirmed that this format strings "flaw" 
is present in Windows 2000 with IIS 5.0, as well as the 
Microsoft FTP service.

I've given up on playing around with this "flaw", so I'm 
posting it to vuln-dev to let other people have a chance 
and see what else can be found.

Cheers,
0x00

Relevant Pages

  • RE: Security and EOL issues (was RE: WMF Exploit Patch released)
    ... While I sympathies with those that feel that Microsoft is getting richer ... Compare AIX to Windows, ... software support for AIX Base Operating System 4.3.3. ... Every vendor releases new builds and patches, ...
    (Security-Basics)
  • Re: Bring back XP
    ... I had to call Microsoft for support, ... that it's Microsoft fault that you don't know. ... Only certain editions of Vista have downgrade rights to XP. ... You don't get 2 licenses of Windows, one to use for Vista and another to ...
    (microsoft.public.windowsxp.general)
  • RE: Stop error message
    ... your Windows Server 2003-based computer ... we cannot help you analyze the dump file in ... Blue Screen Preparation Before Contacting Microsoft ... For a complete list of Microsoft Customer Service and Support phone ...
    (microsoft.public.windowsxp.general)
  • RE: Security and EOL issues (was RE: WMF Exploit Patch released)
    ... Why not set up paid upgrade systems using annual contracts? ... The commitment on the contract is to continue to support as long as contracts are paid with the restriction that the needed support mst be technically feasible and as timely notification as is possible when support is not technically feasible will be provided. ... While I sympathies with those that feel that Microsoft is getting richer ... Compare AIX to Windows, ...
    (Security-Basics)
  • Re: IIS Start up errors
    ... provide the detailed steps to reinstall the IIS server in SBS 2003 server. ... For example, programs such as Microsoft ... In the Currently installed programs list, click Windows Small Business ...
    (microsoft.public.windows.server.sbs)