Microsoft Downplays IIS Bug Threat

snydeq writes "Microsoft confirmed that its IIS Web-server software contains a vulnerability that could let attackers steal data, but downplayed the threat, saying 'only a specific IIS configuration is at risk from this vulnerability.' The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."

Comments

'only a specific IIS configuration is at risk'

[Jurily]

The default?

Re:'only a specific IIS configuration is at risk'

[AliasMarlowe]

Did they give any configuration which is not at risk?

Re:'only a specific IIS configuration is at risk'

[Jurily]

Did they give any configuration which is not at risk?

Yes. it's a hidden one, only attainable by those who see the Light. All hail fdisk!

Re:'only a specific IIS configuration is at risk'

[Anonymous Coward]

Only servers with WEBDAV installed are vulnerable. WEBDAV is not installed and configured by default.

Only IIS 5, 5.1 and 6 are potentially vulnerable under these conditions.

IIS 7 is not vulnerable even with WEBDAV installed.

Re:'only a specific IIS configuration is at risk'

[cayenne8]

"Only servers with WEBDAV installed are vulnerable. WEBDAV is not installed and configured by default."

Sounds like you could avoid it by not allowing Unicode either...

I mean, who really needs 'all' those characters?

Re:'only a specific IIS configuration is at risk'

[Ralish]

Did they give any configuration which is not at risk?

Yes, several: More information about the IIS authentication bypass

Worth noting that this only affects IIS 5.x and 6.x, which admittedly, accounts for the huge majority of IIS webservers, but IIS 7.x (Windows Server 2008 and above) are not affected.

Re:'only a specific IIS configuration is at risk'

[rvw]

I mean, who really needs 'all' those characters?

Here on slashdot, we only need one character: Anonymous Coward!

Re:'only a specific IIS configuration is at risk'

[timbck2]

IIRC, WebDAV *is* configured by default on IIS 5. Here's a link to instructions on disabling it (the procedure involves adding a registry value and restarting IIS):

Microsoft KB Article #241520

Re:'only a specific IIS configuration is at risk'

[queenb**ch]

Prolly is the default... Failure is not an option... it comes bundled with Windows. And the best fix for Windows... installing Ubuntu.

Re:'only a specific IIS configuration is at risk'

[HAKdragon]

What about CowboyNeal?

Re:'only a specific IIS configuration is at risk'

[bloodhawk]

No it is not on by default at all, it has been off by default since windows 2003/IIS6 and II7 is not even vulnerable even if it is turned on. Ubuntu is not a good fix, in fact it is an incredibly bad fix as you would then be using Apache which has had considerably more vulnerabilities in it than IIS6 and II7 combined in the last 5 years.

WebDAV used much?

[TranceThrust]

Is Microsoft 'correct' in downplaying, in the sense that the particular vulnerable configuration mentioned is not used by many?

Re:WebDAV used much?

[Shados]

Yup. You need a fairly specific setup: WebDav enabled on the same application as NTLM authentication (kerberos and anonymous/form is ok as far as I understand), and there must not be anything on top of WebDev for authentication (such as one of the various single signon ISAPIs or a CMS exposing its content through webdav with some form of custom security schemes).

Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios. Don't get me wrong: that is severe, as most hacking DOES come from within.

What makes it far more major, is that its one of the extremely rare remotely exploitable vulnerability that IIS6 have had. Contrary to Slashdot beleif, IIS6 (IIS7 more so though) is totally rock solid and extremely secure, so having something like that pop up is quite scary.

Re:WebDAV used much?

[Anonymous Coward]

Since no one in their right mind will have WebDav and NTLM exposed to a public site

Have you ever worked in IT? Things "no one in their right mind" would do happen all the time. People don't want to remember 10 different passwords, so I can easily see people wanting to be able to update the website with their "windows password". I'm betting this configuration is far more common than you might think.

Re:WebDAV used much?

[blincoln]

Since no one in their right mind will have WebDav and NTLM exposed to a public site

They will if they're running Outlook Web Access, and haven't manually disabled NTLM using a command-line vbscript that comes with IIS.

Re:WebDAV used much?

[gadget junkie]

[...]

What makes it far more major, is that its one of the extremely rare remotely exploitable vulnerability that IIS6 have had. Contrary to Slashdot beleif, IIS6 (IIS7 more so though) is totally rock solid and extremely secure, so having something like that pop up is quite scary.

Contrary to Slashdot belief, Slashdotters usually rant about Microsoft client operating systems, like Vista or Win7. Ranting about Server Software is bad form, primarily because Linux/Apache is the primary platform, and Slashdot should therefore rant that Linux is nipping MS in the bud with its uncompetitive practices.

Re:WebDAV used much?

[93 Escort Wagon]

Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios.

You're making the mistake of assuming that most IIS admins know what they're doing. I'm sure most of them think they know what they're doing, but I'm betting this flaw will get exploited from without much more often than you think it will.

Re:WebDAV used much?

[Amouth]

OWA doesn't use WebDav

i don't know anyone that uses WebDav..

the problem isn't in using NTLM (still not the best thing to do) but it is with WebDav

Re:WebDAV used much?

[dbIII]

IIS6 (IIS7 more so though) is totally rock solid and extremely secure

Reality just stood up and punched that misconception on the nose.

Re:WebDAV used much?

[jimmypw]

I'll concur IIS 6/7 is somewhat solid and acceptably secure that is only if the administrator knows what he is doing. Unfortunatly some if not most IIS setups are incredibly complex thus negating the security features provided.

Re:WebDAV used much?

[blincoln]

There is so much wrong with that statement... First if it is a vbscript, it isn't manual and it isn't command-line.

Do me a favour. Find your IIS root folder (C:\Inetpub by default). Go into the AdminScripts subfolder. Try double-clicking adsutil.vbs and see how well it works running as a GUI app instead of being called from the command line using cscript.

Also when using Windows Integrated Auth, Kerberos is the default authentication. If Kerberos fails, then it uses NTLM. Unless you can provide a link that says otherwise...

Kerberos is allowed by default, but so is NTLM. If you want to *disallow* NTLM, you have to do this using the script I mentioned above, and in my original post. The syntax is e.g.:

cscript -nologo adsutil.vbs SET w3svc/1/root/NTAuthenticationProviders "Negotiate"

Seems pretty manual to me. But what do I know?

PS: You can verify this on your IIS install using the GET version of that command. The default is "Negotiate,NTLM" (which is also true if it's not explicitly defined). Most IIS admins and engineers don't know how to do things like set up SPNs for Kerberos authentication, which I'm sure is why NTLM is allowed by default.

Re:WebDAV used much?

[blincoln]

OWA doesn't use WebDav

It actually does, as I was most disappointed to discover a year or two ago. I don't have time to find official documentation on the MS website, but here's an example of some testing that was done against it.

Re:WebDAV used much?

[Amouth]

But it isn't required.. for that to work you have to allow webdav which isn't default.

you can still use webdav style searchs using exlodb.

OWA works fine with webdav blocked on iis6

Re:WebDAV used much?

[Culture20]

most [successful] hacking DOES come from within.

Edited for correctness. By far, the majority of attempts come from outside.

Re:WebDAV used much?

[TheRaven64]

I'm sure most of them think they know what they're doing

I'm not. The big selling point of IIS is that it's possible to install it and run it by just clicking on a simple GUI, so it can be run by people who don't really understand computers. A lot of 'IIS admins' are likely to be some guy who knows slightly more than anyone else in the company about computers but is really employed to do something else.

Re:WebDAV used much?

[Will.Woodhull]

Parent post has been trounced (doubly!) as a troll, and it certainly dripped sarcastic acid. But the question it posed does seem like a valid one:

Is there any equivalent configuration of Apache that would expose a similar vulnerability? That is, is this kind of vulnerability something that could possibly affect Mac, Linux, BSD, or Unix environments, or is it solely limited to Microsoft shops?

I haven't worked on MS-specific stuff for nearly a decade (except as needed to get MSIE to do what standards-compliant browsers do). So I don't know WebDEV or any of the CASE tools that work with MS. And I'm kind of wondering whether this story has any significance to anyone outside of the Microsoft ecosystem. (Other than the obvious fact that no one should entrust any private data to any web site being run with Microsoft products, unless they are confident that the responsible IT department understands these kinds of risks and goes the extra steps necessary to assure that clients don't become victims.)

Re:WebDAV used much?

[Sylver Dragon]

As far as I know, Apache doesn't have anything like WebDAV directly, there might be all kinds of third party applications which create a similar service, but then they probably have their own host of issues.

To be honest, this falls well within the "meh" category of problems. If you have WebDAV running, either you chose to turn it on for very specific reasons, and hopefully made an informed decision before you did so; or, you are running a decade old version of IIS on a decade old operating system and never changed the defaults.

Re:WebDAV used much?

[charlieman]

"I'm right until you prove me wrong" ?

Re:WebDAV used much?

[marcosdumay]

Well, don't install any Dav file browser trought IIS on a intranet, so. It is so easy to work around such things as not having a web based version control, like subversion, or any kind of web based file sharing... I only hope one's mission critical software don't come with hidden Dav clients.

Re:WebDAV used much?

[blincoln]

The system-wide WebDAV isn't required. Exchange installs its own, separate WebDAV components, which are.

See:

http://support.microsoft.com/kb/309508/ ("Exchange 2000 components use Web Distributed Authoring and Versioning (WebDAV) and other Hypertext Transfer Protocol (HTTP) verbs that are not allowed by the default configuration [of the IIS Lockdown and URLScan tools].")

http://windowsitpro.com/article/articleid/38396/critical-webdav-vulnerability-are-your-exchange-servers-safe.html ("You can't disable WebDAV on your Exchange 2000 servers because OWA 2000 depends on WebDAV")

and

http://windowsitpro.com/article/articleid/45356/deciding-if-and-how-to-disable-webdav-access.html ("If you're trying to disable Exchange 2003's DAV implementation, be aware that Outlook Web Access (OWA) and several other Exchange components depend on DAV. By blocking specific DAV verbs at the network level (through a firewall) or by installing URLScan, you will break the Exchange DAV implementation."). This last article specifically mentions the separate DAV DLLs for Exchange.

Re:WebDAV used much?

[marcosdumay]

Funny thing, since WebDav is the API MS created to let other programs access Exchange OWA.

Re:WebDAV used much?

[blincoln]

Note 1: see this Microsoft article for the official documentation.

Note 2: I suspect that "Negotiate" might actually mean "use the operating-system-level security configurations of the client and the server to determine which protocol is acceptable", so that in order to truly *force* Kerberos you might also have to disallow all varieties of NTLM in the security policy for the server. That's just a guess though.

Re:WebDAV used much?

[iamhigh]

Yep, forgot about cscript having to be called from command line. Wouldn't you know when I try to talk some shit, I am wrong. Oh well, my apologies.

To your other post, negotiate is referring to Kerberos. I don't know why the don't call it Kerberos, but it relies on *negotiating* some crap (I cant remember details right now) and then sending credentials. Confusing, yes.

Re:WebDAV used much?

[Shados]

Yeah I realized that after I posted, that it could be taken as "attempt". Obviously, especially with all the script kiddies and bots, it mostly comes from the outside, but most of those are against patched vulnerabilities. Even in high profile companies like banks, there is a general feeling of "Who would hack us from the inside?! They wouldn't even know how!!!", without realizing how quickly the secretary will learn how to run a hacker's script if you piss her off on the wrong day.

Re:WebDAV used much?

[Shados]

But Exchange and Sharepoint exposed through webdav are not vulnerable to this exploit, only file systems are, and its a different ballpark altogether. As soon as there's some form of indirect authentication layer in between, instead of straight NTLM, it doesn't work anymore.

Subliminal messaging

[ZinnHelden]

'only a specific IIS configuration is at risk from this vulnerability.'

In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"

Re:Subliminal messaging

[Jurily]

In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"

Funny. It sounded like "use software with open standards and secure implementations" to me.

Re:Subliminal messaging

[ZinnHelden]

Yeah, I may hear their insane whispering, but I'm not giving up my Citadel server.

Re:Subliminal messaging

[goltzc]

Don't portions of SharePoint use webdav and ntlm authentication?

Re:Subliminal messaging

[lukas84]

Yes, of course.

But publishing Sharepoint directly to the Internet is insane. You should put an ALG in front of it, for example ISA Server.

Re:Subliminal messaging

[Richard_at_work]

Both are fairly fundamental parts of SharePoint for the integration features, but you would never expose either to the world when using an external facing SharePoint deployment. Also your SharePoint server should be behind an application aware firewall such as ISA Server anyway.

Re:Subliminal messaging

[Ralish]

Funny. It sounded like "use software with open standards and secure implementations" to me.

I personally use Apache for my web-facing server, but that being said, IIS 6 (Windows Server 2003) has had a very good security track record. Secunia tracks 6 advisories since its release back in 2003 and only one of those is unpatched, that being the vulnerability this story is about.

In contrast, Apache 2.2 was released in late 2005 and has 10 exploits listed, with 2 unpatched and 2 with partial fixes. The exploits seem to be on average less severe, but there's more of them, and some aren't patched.

My point being, you might not want to jump to conclusions ;) IIS 5.x and earlier was absolutely shocking for security, but IIS 6.x and above does have significant improvements. It's no coincidence that IIS 6 is not vulnerable to this exploit out of the box while IIS 5 is.

Re:Subliminal messaging

[marcosdumay]

As do some portions of Exchange. The GP was probably after some Funny mods, not informative.

It deosn't seem to be default...

[tychovi]

since ~70% of the hits on a quick google are how to turn on and configure WebDAV. But this also means that there seems to be a good bit of interest in using it...

Not a typical configuration

[jsnipy]

This is really not a typically configuration for an outward facing site. Acting like this is some great find and "game over" scenario is a little far fetched. "Downplay" is flamebait in this context. But, it does make a good m$ bashing opportunity!

Re:Not a typical configuration

[Idiot with a gun]

Mayhaps it isn't a major bug, but this is exactly what Microsoft does every time. Downplay their bugs (and take their sweet time patching them), while bashing any high profile bugs that crop up in open source projects. I'd be more impressed if their response was "There's a bug in IIS, don't use feature X or configuration Y while we fix it."

Re:Not a typical configuration

[Ralish]

Workaround #1: Turn off WebDAV
Turning off WebDAV might be a good option if you are not using it or can live without out until we have a security update available. You can find instructions at http://support.microsoft.com/kb/241520.

Source: http://blogs.technet.com/srd/archive/2009/05/18/more-information-about-the-iis-authentication-bypass.aspx

Re:Not a typical configuration

[turbidostato]

"Turning off WebDAV might be a good option if you are not using it or can live without out until we have a security update available"

Of course, not turning it on to start with, if you don't use it or can live without it is out of consideration.

For more information

[itayperl]

See http://milw0rm.com/exploits/8704.

oblig

[Benanov]

One that isn't installed.

Re:oblig

[jonaskoelker]

Lalalala, I'm not listen(2)ing! ;-)

ISS bug

[googlesmith123]

Nasa downplays ISS bug.

Re:ISS bug

[Ash-Fox]

Nasa downplays ISS bug.

Fortunately they have got a Russian on board the space station.

"This is how we fix things on Russian space station!" --Lev Andropov

(He then proceeds to take a hammer and whack the equipment.)

The researcher nixes MS downplaying

[Twillerror]

http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html

Several news stories seem to allude that Microsoft is artificially downplaying the threat, citations of myself are used to underline the headline in an "us against Microsoft" kind of way. I want to clarify that I have the utmost respect of the MSRC team and I don't suspect Microsoft to willingly downplay anything. They also claim I am from Belgium, I am obviously from Luxembourg. The bug also is not the same as the IIS4/5 one, it's root cause is similar. That's about it.

Internal Memo

[geoffrobinson]

To Whom It May Be Concerned:

Warner Bros., in an ill-advised attempt to promote Terminator Salvation, created a Skynet virus which aims to take over the world.

For some reason, it targets IIS.

We're doomed. Please head to the bomb shelter and the world will start again with a base of Microsoft employees.

thank you,
Management

Re:Internal Memo

[geoffrobinson]

While I'm glad they are setting this movie in the future, my enthusiasm has been diminished by the cancellation. Seriously, I need to make sure I don't get too attached to any show on that network.

Re:Internal Memo

[SBrach]

Like the Simpsons?

Serious question

[Ash-Fox]

Serious question, has the Apache package even had any bad vulnerabilities like this in the past ten years?

Re:Serious question

[iamhigh]

Check for yourself... http://secunia.com/advisories/search/?search=Apache&sort_by=date

Re:Serious question

[Just Some Guy]

That query shows all results even tangentially related to Apache family. You need to look at the advisories for Apache 2.2, Apache 2.0, and Apache 1.3 specifically.

Re:Serious question

[AvitarX]

I see 541 advisories(many look like duplicates by distro at a glance), but I am NOT going to look for myself and see if any of them are major. That sounds like a lot of work.

Re:Serious question

[dkleinsc]

For lazy people, about 3 vulnerabilities classified as "Highly" critical, 0 "Extremely", out of a total of around 50 across Apache 1, Apache 2.0.x, and Apache 2.2.x. Of the 50, the vast majority are at least partially fixed.

It's hard to get a fix on equivalent numbers for IIS, since they all seem to fall under the MS Windows category.

Re:Serious question

[Twillerror]

Serious answer. Apache is a modular beast and since doesn't get blaimed for modular problems like this.

There have been issues even bigger in various mods like mod_php.

Even code red was a problem with Internet printing and not really the core IIS. Maybe IIS should have blocked it and already had URLScan, but ultimately it was just passing a URL along some C++ code that blew up. MS created that .DLL so we can blame MS..but blaiming IIS itself was slightly off.

The core of both IIS and Apache have been pretty well hardened. Hence why WebDav is turned off in IIS 6. Even .ASP has to be turned on during setup.

MS puts out it's own mods essentially...where Apache would have a different team working on WebDAV. If the same "exploit" was found in mod_webdav who could we really blame. Yell at the Apache foundation...no we would professionally fix the issue. Maybe some flaimbaiters on the other side would yell..."see open source is less secure".

Softwares has bugs, some of them are security related. When open source creates them they are presented as bugs...when MS creates them it is some kind of great conspiracy to rule the world. Some guy just like you wrote this bad code and is probably feeling like crap today. Some tester let it get thru and is feeling really crappy today. A bunch of dudes in at both MS and the rest of the security community are pulling up their britches and getting it fixed...move along nothing to really see here.

Re:Serious question

[Foofoobar]

Well the problem isn't just that one developer and tester let it through. They let it through TWICE! After the first time, you would have thought that they would have built a class/function/api to handle all URL's and do the cleaning automatically. That way any app sending URL's through the system could have them cleaned the same way so as to avoid an exploit.

This constant lack of consistency is a Microsoft trademark where one hand doesn't know what the other hand is doing and as a result issues that they say were fixed keep coming up over and over and over. And I think that's the real bitch people have. If there's any kind of conspiracy, it's a conspiracy of dunces.

Re:Serious question

[cl0s]

Yea difference is, if I'm Big Company A using Apache and we find a bug/security flaw we can hire someone to fix it or call up apache or the mod creator and pay him to fix it immediately and patch our servers. Big Company B that uses IIS finds a bug and they can either turn the service off and wait for a fix to be released (which might not be an option depending on how critical that service is for the company) or just have to hope its not exploited while Microsoft patches it - whenever they feel like, depending on the severity and how many other customers it also effects, etc.. Even Small Company can have an influence or fix whatever is found in Apache themselves. With IIS, you kind of just have t wait.

I don't care which one you prefer but that's just the truth of it.

Re:Serious question

[Anonymous Coward]

Actually, if you're a big enough company you can get the same response from Microsoft. You call through their incident support line and get through to the project support lead for the product in question and they can manage putting together a hot fix. It will cost you, but it would cost you either way. I worked for a fairly small company five years ago and we got the lead developer from the Microsoft SNA division to create a custom patch for a bug that we identified on a Sunday morning at 2:00 AM. In all it cost us $200.

In the majority of cases the company is going to sit tight and wait on support through the platform company, whether that be Microsoft, Red Hat, Oracle, Dell, whatever. The number of companies that actually seek out a custom fix would be in the extreme minority as deploying such custom code into a production environment is a liability in of itself.

Re:Serious question

[marcosdumay]

Wow! Using a 403 error page to make another server put bad code into the user's browser is genial. That is why I like security people, I'd never think about something lke that.

Re:Serious question

[Jahava]

You posted good information and a nice perspective. I do agree with what you say, in spirit.

However, let's not forget that neither Microsoft nor Apache, including their coders and contributers, is innocent. They're both competing in an arena to provide drop-in solutions that form a backbone of the most technologically-vast infrastructure in the world (the Internet). There's money to be had, and responsibility comes right alongside it. Your kind of thinking, while very empathetic, is dangerous, as we have to hold these companies to a higher standard of coding.

It's a shame, but tons of people did fail miserably, and the failure could be enough to ruin the lives and livelihood of the victims (even if there are relatively few). Failing that, countless man-hours are being spent addressing, patching, avoiding, and detecting this bug. As small of a coding mistake as it is, it's going to cost a lot of people a lot of money, especially because of the popularity and criticality of the software.

Then again, if high-profile applications were properly jailed (on both Windows and Linux), it wouldn't be much of an issue at all. A lot of people are to blame for this not being pervasively commonplace.

Re:Serious question

[bloodhawk]

It's hard to get a fix on equivalent numbers for IIS, since they all seem to fall under the MS Windows category.

its not hard at all. http://secunia.com/advisories/product/1438/ http://secunia.com/advisories/product/17543/

Re:Are they big enough?

[x2A]

Anything Microsoft related on Slashdot forums is automatically flamebait because of the emotional reactions the mere word 'Microsoft' triggers in so many Slashdotters which makes it unpossible to have a proper serious, well thought out debate. Just look at the replies it's getting. It's pathetic huh.

It's not a big deal

[SlappyBastard]

Anyone using the exploit is prompted repeatedly about whether they really, really want to do it.

Geez. Don't you people know anything about Windows security?

Re:It's not a big deal

[pyrr]

Security by annoyance?

Re:No not a Microsoft Bug

[Paralizer]

Are you implying that no other operating system has bugs, or that open source guarantees bug free code? I'm pretty sure you'd be wrong.

(Disclaimer: I love Linux and have been using it at home for years, but I'm sure as hell not going to go around and tell everyone that it's rock solid and bug free just because it's open and I like it.)

Re:No not a Microsoft Bug

[heffrey]

This attitude (open implies better) is what I call faith based IT.

Translation for American audiences ONLY

[Zontar_Thing_From_Ve]

They also claim I am from Belgium, I am obviously from Luxembourg.

I used to work at a US office of a large French company, so I have some insights into this statement that might not be apparent to the typical American. Consider this as if he had said:
They also claim I am from Alabama. I am obviously from Tennessee.
and you'll have a rough idea of what he is saying and why he doesn't like it to be said that he's from Belgium.

Re:Translation for American audiences ONLY

[ShadowRangerRIT]

But I'm from D.C., and live in NYC. So both Alabama and Tennessee sound like hick country to me! Can I get a different analogy?

I'm half joking.

Re:Are they big enough?

[Anonymous Coward]

That sounded dangerously close to being pro-Microsoft, comrade...

Re:No not a Microsoft Bug

[LinuxOverWindows]

I never said that, but what I'm implying and is true with out a doubt is that closed source has more bugs!

Re:Are they big enough?

[x2A]

What, because emotional hysteria is the necessary defence for Microsoft's evils in the world? If we aren't angry and if we don't hate, then MS wins???

not a typically configuration

[rs232]

"This is really not a typically configuration for an outward facing site"

How do you know this, is IIS shiped by default with this 'safe' configuration?

"the flaw is currently being exploited in online attacks, according to CERT", and according to theReg, Ball State University was hacked using this exact same exploit.

'Shortly after the attack, students checking their iWeb pages were greeted with a message that said they had been hacked'

Re:not a typically configuration

[Shados]

How do you know this, is IIS shiped by default with this 'safe' configuration?

More so than that: not only is the feature not activated by default, its not even installed. And NTLM on a public facing web site means someone made the conscious decision of disabling anonymous and form authentication (as those would always kick in first, thus almost closing down NTLM access in the first place). If you have a firewall, the appropriate port may need to be opened, too, in some cases.

It is not the default by any stretch of the imagination, and you actually need to sorta know what you're doing. At work we have douzens of distinct IIS setup and configurations, stretching from very common to extremely obscure, and we looked at all of them one by one, only to find out that exactly zero had the correct setup for this vulnerability, and no one actually tried to lock down NTLM + WebDav. Its just that the only time you'd go through the trouble of making it available, is for Exchange, Sharepoint, etc, and those setups are not vulnerable.

Re:not a typically configuration

[rs232]

"NTLM on a public facing web site means someone made the conscious decision of disabling anonymous and form authentication"

You are confusing me, I thought NTLM was the authentication mechanism used by IIS, and what is IIS if not a web server. Is there any technical advisory that IIS shouldn't be used on a public facing web site? and also .. did the admins at Ball State University disable anonymous and form authentication?

Re:not a typically configuration

[Shados]

NTLM is the basic form of Windows Authentication, which is used when integrated authentication is needed, but Kerberos would be overkill. So its basically how you login to a windows box. Internet Explorer and some (but not all...though Firefox can) other browsers will let you use it for website authentication, but it rests that its a form of network authentication that is not optimized for public networks (it is most commonly used to authenticate users on an intranet so they don't have to enter their password again, just passing their windows tokens).

On the web, usually people will use form based authentication (the windows world way of saying "username and password backed by a custom system"). In the Unix world (though it can be used in Windows too), some form of single sign-on framework (like SiteMinder) is often used too.

So basically, exposing NTLM over the public internet would mean your web site will work in most, but not all browsers, and people will be asked to enter a windows login name and password (as in Active Directory or machine user). That is very infrequent.

The only times this is really done is for Sharepoint and Exchange, and those use a custom security mechanism which is not vulnerable to this exploit (because they serve "virtual" directories such as files from a content management systems or a email database, as opposed to a real file system).

And like if all that wasn't enough, exposing NTLM over the net is confusing to users (sometimes they have to type in the domain name, depending on configuration... talk about ewww) and doesn't integrate well in web pages (it will pop that ugly gray login box instead of being integrated in the site), thus why even braindead sysadmins won't make the mistake, because users bitch and moan.

If a university got hacked through this, when even our straight-out-of-associate junior MCSE didn't make the mistake, they really need to rethink their IT department.

This is another Unicode hole

[spitzak]

It sounds like the basic cause is something attempting to translate a string into "unicode" before using it.

For some reason, normally intelligent programmers turn into complete morons when presented with UTF-8 and other Unicode encodings. They become convinced that it is somehow physically impossible to do anything to these strings without first finding all the "characters" (actually Unicode code points, which are not "characters") and will write pages and pages of elaborate and bug-prone code to do this and "count characters". This code is COMPLICATED and there is the basic fact that the mapping is often not 1:1 and even when it is different implementations vary and thus don't invert correctly. This causes bugs, nasty ones like you can see right. here.

In fact it would be trivial to just treat it as a string of bytes that happens to maybe represent some text. The ONLY time you need "characters" is when you are rendering the string into an image that humans will look at, and if you want to do semantic analysis such as grammar checking. It is not needed if you are looking for the period that starts the extension or trying to find a number.

What is really sad and mysterious is that this disease only seems to be triggered by UTF-8. Nobody worries about finding the boundaries between "words". Nobody seems to worry about UTF-16 surrogate pairs, and nobody was really concerned with older Japanese multi-byte encodings.

This is NOT Microsoft-specific so don't feel complacent. Microsoft's moronic decision to name files with UTF-16 is really bad, but witness open source Python 3.0 which has decided that all strings will have to be converted to "unicode" (acutally UTF-16 or UTF-32 depending on the platform) before anything is done to them. Python is heavily used to parse HTML and URLs and I expect a huge mess from this stupid idea.

I'm sure there will be a few responses claiming some magical property of "characters" so that you can't do anything about it. PLEASE, try some thought experiments. Try substituting "words" in your example, it will either be stupid, or you will realize that that only a tiny portion of software needs it. Go and write some code where you leave the strings in UTF-8 and maybe you will learn.

Re:No not a Microsoft Bug

[heffrey]

Really? What's your evidence for that statement?