Microsoft Downplays IIS Bug Threat

snydeq writes "Microsoft confirmed that its IIS Web-server software contains a vulnerability that could let attackers steal data, but downplayed the threat, saying 'only a specific IIS configuration is at risk from this vulnerability.' The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."

Comments

'only a specific IIS configuration is at risk'

[Jurily]

The default?

Re:'only a specific IIS configuration is at risk'

[AliasMarlowe]

Did they give any configuration which is not at risk?

Re:'only a specific IIS configuration is at risk'

[Jurily]

Did they give any configuration which is not at risk?

Yes. it's a hidden one, only attainable by those who see the Light. All hail fdisk!

Re:'only a specific IIS configuration is at risk'

[Anonymous Coward]

Only servers with WEBDAV installed are vulnerable. WEBDAV is not installed and configured by default.

Only IIS 5, 5.1 and 6 are potentially vulnerable under these conditions.

IIS 7 is not vulnerable even with WEBDAV installed.

Re:'only a specific IIS configuration is at risk'

[cayenne8]

"Only servers with WEBDAV installed are vulnerable. WEBDAV is not installed and configured by default."

Sounds like you could avoid it by not allowing Unicode either...

I mean, who really needs 'all' those characters?

Re:'only a specific IIS configuration is at risk'

[Ralish]

Did they give any configuration which is not at risk?

Yes, several: More information about the IIS authentication bypass

Worth noting that this only affects IIS 5.x and 6.x, which admittedly, accounts for the huge majority of IIS webservers, but IIS 7.x (Windows Server 2008 and above) are not affected.

Re:'only a specific IIS configuration is at risk'

[timbck2]

IIRC, WebDAV *is* configured by default on IIS 5. Here's a link to instructions on disabling it (the procedure involves adding a registry value and restarting IIS):

Microsoft KB Article #241520

Re:WebDAV used much?

[Shados]

Yup. You need a fairly specific setup: WebDav enabled on the same application as NTLM authentication (kerberos and anonymous/form is ok as far as I understand), and there must not be anything on top of WebDev for authentication (such as one of the various single signon ISAPIs or a CMS exposing its content through webdav with some form of custom security schemes).

Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios. Don't get me wrong: that is severe, as most hacking DOES come from within.

What makes it far more major, is that its one of the extremely rare remotely exploitable vulnerability that IIS6 have had. Contrary to Slashdot beleif, IIS6 (IIS7 more so though) is totally rock solid and extremely secure, so having something like that pop up is quite scary.

Not a typical configuration

[jsnipy]

This is really not a typically configuration for an outward facing site. Acting like this is some great find and "game over" scenario is a little far fetched. "Downplay" is flamebait in this context. But, it does make a good m$ bashing opportunity!

For more information

[itayperl]

See http://milw0rm.com/exploits/8704.

oblig

[Benanov]

One that isn't installed.

The researcher nixes MS downplaying

[Twillerror]

http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html

Several news stories seem to allude that Microsoft is artificially downplaying the threat, citations of myself are used to underline the headline in an "us against Microsoft" kind of way. I want to clarify that I have the utmost respect of the MSRC team and I don't suspect Microsoft to willingly downplay anything. They also claim I am from Belgium, I am obviously from Luxembourg. The bug also is not the same as the IIS4/5 one, it's root cause is similar. That's about it.

Internal Memo

[geoffrobinson]

To Whom It May Be Concerned:

Warner Bros., in an ill-advised attempt to promote Terminator Salvation, created a Skynet virus which aims to take over the world.

For some reason, it targets IIS.

We're doomed. Please head to the bomb shelter and the world will start again with a base of Microsoft employees.

thank you,
Management

Re:Subliminal messaging

[ZinnHelden]

Yeah, I may hear their insane whispering, but I'm not giving up my Citadel server.

Serious question

[Ash-Fox]

Serious question, has the Apache package even had any bad vulnerabilities like this in the past ten years?

Re:Serious question

[Twillerror]

Serious answer. Apache is a modular beast and since doesn't get blaimed for modular problems like this.

There have been issues even bigger in various mods like mod_php.

Even code red was a problem with Internet printing and not really the core IIS. Maybe IIS should have blocked it and already had URLScan, but ultimately it was just passing a URL along some C++ code that blew up. MS created that .DLL so we can blame MS..but blaiming IIS itself was slightly off.

The core of both IIS and Apache have been pretty well hardened. Hence why WebDav is turned off in IIS 6. Even .ASP has to be turned on during setup.

MS puts out it's own mods essentially...where Apache would have a different team working on WebDAV. If the same "exploit" was found in mod_webdav who could we really blame. Yell at the Apache foundation...no we would professionally fix the issue. Maybe some flaimbaiters on the other side would yell..."see open source is less secure".

Softwares has bugs, some of them are security related. When open source creates them they are presented as bugs...when MS creates them it is some kind of great conspiracy to rule the world. Some guy just like you wrote this bad code and is probably feeling like crap today. Some tester let it get thru and is feeling really crappy today. A bunch of dudes in at both MS and the rest of the security community are pulling up their britches and getting it fixed...move along nothing to really see here.

It's not a big deal

[SlappyBastard]

Anyone using the exploit is prompted repeatedly about whether they really, really want to do it.

Geez. Don't you people know anything about Windows security?

Re:WebDAV used much?

[blincoln]

Since no one in their right mind will have WebDav and NTLM exposed to a public site

They will if they're running Outlook Web Access, and haven't manually disabled NTLM using a command-line vbscript that comes with IIS.

Re:WebDAV used much?

[93 Escort Wagon]

Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios.

You're making the mistake of assuming that most IIS admins know what they're doing. I'm sure most of them think they know what they're doing, but I'm betting this flaw will get exploited from without much more often than you think it will.

Re:WebDAV used much?

[blincoln]

There is so much wrong with that statement... First if it is a vbscript, it isn't manual and it isn't command-line.

Do me a favour. Find your IIS root folder (C:\Inetpub by default). Go into the AdminScripts subfolder. Try double-clicking adsutil.vbs and see how well it works running as a GUI app instead of being called from the command line using cscript.

Also when using Windows Integrated Auth, Kerberos is the default authentication. If Kerberos fails, then it uses NTLM. Unless you can provide a link that says otherwise...

Kerberos is allowed by default, but so is NTLM. If you want to *disallow* NTLM, you have to do this using the script I mentioned above, and in my original post. The syntax is e.g.:

cscript -nologo adsutil.vbs SET w3svc/1/root/NTAuthenticationProviders "Negotiate"

Seems pretty manual to me. But what do I know?

PS: You can verify this on your IIS install using the GET version of that command. The default is "Negotiate,NTLM" (which is also true if it's not explicitly defined). Most IIS admins and engineers don't know how to do things like set up SPNs for Kerberos authentication, which I'm sure is why NTLM is allowed by default.

Re:WebDAV used much?

[blincoln]

The system-wide WebDAV isn't required. Exchange installs its own, separate WebDAV components, which are.

See:

http://support.microsoft.com/kb/309508/ ("Exchange 2000 components use Web Distributed Authoring and Versioning (WebDAV) and other Hypertext Transfer Protocol (HTTP) verbs that are not allowed by the default configuration [of the IIS Lockdown and URLScan tools].")

http://windowsitpro.com/article/articleid/38396/critical-webdav-vulnerability-are-your-exchange-servers-safe.html ("You can't disable WebDAV on your Exchange 2000 servers because OWA 2000 depends on WebDAV")

and

http://windowsitpro.com/article/articleid/45356/deciding-if-and-how-to-disable-webdav-access.html ("If you're trying to disable Exchange 2003's DAV implementation, be aware that Outlook Web Access (OWA) and several other Exchange components depend on DAV. By blocking specific DAV verbs at the network level (through a firewall) or by installing URLScan, you will break the Exchange DAV implementation."). This last article specifically mentions the separate DAV DLLs for Exchange.