CERT-MU Vulnerability Note VN-2009-23

Microsoft IIS FTP Buffer Overflow Vulnerability

Original Issue Date: September 01, 2009

Severity Rating: Medium

Affected Softwares

• Microsoft Internet Information Server (IIS) 5.0
• Microsoft Internet Information Server (IIS) 6.0

Overview

A vulnerability has been identified in Microsoft Internet Information Server (IIS), which could be exploited by a remote, authenticated attacker to execute arbitrary code on a vulnerable system.

Description

This issue is caused by a buffer overflow error in the FTP service when processing an NLST (NAME LIST) command on a specially-named directory. This could allow a remote, authenticated attacker with write access, to crash an affected server or execute arbitrary code with SYSTEM privileges by using the Anonymous account or another account that is available to the attacker.

Workaround

• Disable anonymous write access to IIS FTP server

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

References

US-CERT
http://www.kb.cert.org/vuls/id/276653

VUPEN Security
http://www.vupen.com/english/advisories/2009/2481