ASB00-20
Published: 2000-07-31 00:00:00
Updated: 2000-07-31 00:00:00
Allaire Security Bulletin (ASB00-20)
Microsoft: Patch Available for "Absent Directory Browser Argument" Vulnerability
Originally Posted: July 31, 2000
Last Updated: July 31, 2000
Summary
Microsoft has released a patch that eliminates two security vulnerabilities in
Microsoft(r) Internet Information Server. In sum, the vulnerabilities could allow a
malicious user to stop the web server from providing useful service, or to extract
certain types of information from it. This is not a problem with ColdFusion Server
itself, but it is an issue that can affect ColdFusion users. Allaire recommends
that customers follow the instructions posted on the Microsoft Web site to
address this issue.
Issue
This issue is clearly explained in the Microsoft Security Bulletin:
There are two vulnerabilities at issue here:
The "Absent Directory Browser Argument" vulnerability.
An administrative script installed as part of IIS 3.0
but preserved on upgrade to IIS 4.0 or IIS 5.0 does
not correctly handle the case where an expected
argument is missing. The absence of the argument
causes the script to go into an infinite loop, at
which point the script consumes all CPU resources on
the server. In addition, the permissions on this tool
and several related ones, which were appropriate under
IIS 3.0, are inappropriate under IIS 4.0 and 5.0. This
could allow web site visitors to use these tools,
which provide the ability to view the directory
structure on the server.
A new variant on the "File Fragment Reading via .HTR"
vulnerability. The original version of this
vulnerability was discussed in Microsoft Security
Bulletin MS00-031. The new vulnerability differs only
in the specific way that it could be exploited - like
the original version, the effect of the vulnerability
is that fragments of .ASP and other files could
potentially be retrieved from the server. As in the
original version, the mechanics of the new variant
make it likely that the parts of an .ASP file most
interesting to a malicious user would be stripped out.
Source: Microsoft Security Bulletin (MS00-044) [online]. [Redmond, Washington,
USA] : Microsoft, July 2000 [cited 28 July 2000]. Available from World Wide Web:
<http://www.microsoft.com/technet/security/bulletin/ms00-044.asp>.
Affected Software Versions
Microsoft Internet Information Server 4.0
Microsoft Internet Information Server 5.0
What Allaire is Doing
This is not an Allaire product. We are recommending that customers reference
the information at Microsoft's site to address this issue.
What Customers Should Do
There is a patch available to correct this problem. It is detailed in the following
Microsoft Security Bulletin (MS00-044):
http://www.microsoft.com/technet/security/bulletin/ms00-044.asp
Please note: this issue and patch may not be required for all users. Allaire
customers should review all material in the Microsoft Security Bulletin and
related documents carefully before applying the patch. As always, customers
should test patch changes in a testing environment before modifying
production servers.
Revisions
July 31, 2000 -- Bulletin first created.
Reporting Security Issues
Allaire is committed to addressing security issues and providing customers with
the information on how they can protect themselves. If you identify what you
believe may be a security issue with an Allaire product, please send an email to
secure@allaire.com. We will work to appropriately address and communicate
the issue.
Receiving Security Bulletins
When Allaire becomes aware of a security issue that we believe significantly
affects our products or customers, we will notify customers when appropriate.
Typically this notification will be in the form of a security bulletin explaining the
issue and the response. Allaire customers who would like to receive notification
of new security bulletins when they are released can sign up for our security
notification service.
For additional information on security issues at Allaire, please visit the Security
Zone at:
http://www.allaire.com/security.
THE INFORMATION PROVIDED BY ALLAIRE IN THIS BULLETIN IS PROVIDED "AS IS" WITHOUT
WARRANTY OF ANY KIND. ALLAIRE DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR
IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE. IN NO EVENT SHALL ALLAIRE CORPORATION OR ITS SUPPLIERS BE
LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF ALLAIRE
CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
Allaire reserves the right, from time to time, to update the information in this
document with current information.
