Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Microsoft Bug Security IT

Microsoft Downplays IIS Bug Threat 114

Posted by Soulskill
from the this-is-not-the-bug-you're-looking-for dept.
snydeq writes "Microsoft confirmed that its IIS Web-server software contains a vulnerability that could let attackers steal data, but downplayed the threat, saying 'only a specific IIS configuration is at risk from this vulnerability.' The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."
This discussion has been archived. No new comments can be posted.

Microsoft Downplays IIS Bug Threat

Comments Filter:
  • by Jurily (900488) <jurily&gmail,com> on Wednesday May 20, 2009 @07:56AM (#28024153)

    The default?

  • WebDAV used much? (Score:2, Interesting)

    by TranceThrust (1391831)
    Is Microsoft 'correct' in downplaying, in the sense that the particular vulnerable configuration mentioned is not used by many?
    • Re:WebDAV used much? (Score:5, Informative)

      by Shados (741919) on Wednesday May 20, 2009 @08:03AM (#28024217)

      Yup. You need a fairly specific setup: WebDav enabled on the same application as NTLM authentication (kerberos and anonymous/form is ok as far as I understand), and there must not be anything on top of WebDev for authentication (such as one of the various single signon ISAPIs or a CMS exposing its content through webdav with some form of custom security schemes).

      Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios. Don't get me wrong: that is severe, as most hacking DOES come from within.

      What makes it far more major, is that its one of the extremely rare remotely exploitable vulnerability that IIS6 have had. Contrary to Slashdot beleif, IIS6 (IIS7 more so though) is totally rock solid and extremely secure, so having something like that pop up is quite scary.

      • Re: (Score:2, Insightful)

        by Anonymous Coward


        Since no one in their right mind will have WebDav and NTLM exposed to a public site

        Have you ever worked in IT? Things "no one in their right mind" would do happen all the time. People don't want to remember 10 different passwords, so I can easily see people wanting to be able to update the website with their "windows password". I'm betting this configuration is far more common than you might think.

      • Re:WebDAV used much? (Score:5, Informative)

        by blincoln (592401) on Wednesday May 20, 2009 @08:56AM (#28024735) Homepage Journal

        Since no one in their right mind will have WebDav and NTLM exposed to a public site

        They will if they're running Outlook Web Access, and haven't manually disabled NTLM using a command-line vbscript that comes with IIS.

        • by iamhigh (1252742)

          They will if they're running Outlook Web Access, and haven't manually disabled NTLM using a command-line vbscript that comes with IIS.

          There is so much wrong with that statement... First if it is a vbscript, it isn't manual and it isn't command-line.

          Also when using Windows Integrated Auth, Kerberos is the default authentication. If Kerberos fails, then it uses NTLM. Unless you can provide a link that says otherwise...

          • Re:WebDAV used much? (Score:5, Informative)

            by blincoln (592401) on Wednesday May 20, 2009 @09:47AM (#28025429) Homepage Journal

            There is so much wrong with that statement... First if it is a vbscript, it isn't manual and it isn't command-line.

            Do me a favour. Find your IIS root folder (C:\Inetpub by default). Go into the AdminScripts subfolder. Try double-clicking adsutil.vbs and see how well it works running as a GUI app instead of being called from the command line using cscript.

            Also when using Windows Integrated Auth, Kerberos is the default authentication. If Kerberos fails, then it uses NTLM. Unless you can provide a link that says otherwise...

            Kerberos is allowed by default, but so is NTLM. If you want to *disallow* NTLM, you have to do this using the script I mentioned above, and in my original post. The syntax is e.g.:

            cscript -nologo adsutil.vbs SET w3svc/1/root/NTAuthenticationProviders "Negotiate"

            Seems pretty manual to me. But what do I know?

            PS: You can verify this on your IIS install using the GET version of that command. The default is "Negotiate,NTLM" (which is also true if it's not explicitly defined). Most IIS admins and engineers don't know how to do things like set up SPNs for Kerberos authentication, which I'm sure is why NTLM is allowed by default.

            • Re: (Score:3, Informative)

              by blincoln (592401)

              Note 1: see this Microsoft article [microsoft.com] for the official documentation.

              Note 2: I suspect that "Negotiate" might actually mean "use the operating-system-level security configurations of the client and the server to determine which protocol is acceptable", so that in order to truly *force* Kerberos you might also have to disallow all varieties of NTLM in the security policy for the server. That's just a guess though.

            • by iamhigh (1252742)
              Yep, forgot about cscript having to be called from command line. Wouldn't you know when I try to talk some shit, I am wrong. Oh well, my apologies.

              To your other post, negotiate is referring to Kerberos. I don't know why the don't call it Kerberos, but it relies on *negotiating* some crap (I cant remember details right now) and then sending credentials. Confusing, yes.
          • "I'm right until you prove me wrong" ?

        • by Amouth (879122)

          OWA doesn't use WebDav

          i don't know anyone that uses WebDav..

          the problem isn't in using NTLM (still not the best thing to do) but it is with WebDav

        • by Shados (741919)

          But Exchange and Sharepoint exposed through webdav are not vulnerable to this exploit, only file systems are, and its a different ballpark altogether. As soon as there's some form of indirect authentication layer in between, instead of straight NTLM, it doesn't work anymore.

      • Re: (Score:2, Flamebait)

        by gadget junkie (618542)

        [...]

        What makes it far more major, is that its one of the extremely rare remotely exploitable vulnerability that IIS6 have had. Contrary to Slashdot beleif, IIS6 (IIS7 more so though) is totally rock solid and extremely secure, so having something like that pop up is quite scary.

        Contrary to Slashdot belief, Slashdotters usually rant about Microsoft client operating systems, like Vista or Win7. Ranting about Server Software is bad form, primarily because Linux/Apache is the primary platform, [netcraft.com] and Slashdot should therefore rant that Linux is nipping MS in the bud with its uncompetitive practices.

      • by 93 Escort Wagon (326346) on Wednesday May 20, 2009 @09:03AM (#28024811)

        Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios.

        You're making the mistake of assuming that most IIS admins know what they're doing. I'm sure most of them think they know what they're doing, but I'm betting this flaw will get exploited from without much more often than you think it will.

        • I'm sure most of them think they know what they're doing

          I'm not. The big selling point of IIS is that it's possible to install it and run it by just clicking on a simple GUI, so it can be run by people who don't really understand computers. A lot of 'IIS admins' are likely to be some guy who knows slightly more than anyone else in the company about computers but is really employed to do something else.

      • Re: (Score:3, Funny)

        by dbIII (701233)

        IIS6 (IIS7 more so though) is totally rock solid and extremely secure

        Reality just stood up and punched that misconception on the nose.

      • by jimmypw (895344)
        I'll concur IIS 6/7 is somewhat solid and acceptably secure that is only if the administrator knows what he is doing. Unfortunatly some if not most IIS setups are incredibly complex thus negating the security features provided.
      • by Culture20 (968837)

        most [successful] hacking DOES come from within.

        Edited for correctness. By far, the majority of attempts come from outside.

        • by Shados (741919)

          Yeah I realized that after I posted, that it could be taken as "attempt". Obviously, especially with all the script kiddies and bots, it mostly comes from the outside, but most of those are against patched vulnerabilities. Even in high profile companies like banks, there is a general feeling of "Who would hack us from the inside?! They wouldn't even know how!!!", without realizing how quickly the secretary will learn how to run a hacker's script if you piss her off on the wrong day.

      • Well, don't install any Dav file browser trought IIS on a intranet, so. It is so easy to work around such things as not having a web based version control, like subversion, or any kind of web based file sharing... I only hope one's mission critical software don't come with hidden Dav clients.
  • 'only a specific IIS configuration is at risk from this vulnerability.'

    In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"

    • Re: (Score:3, Insightful)

      by Jurily (900488)

      In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"

      Funny. It sounded like "use software with open standards and secure implementations" to me.

      • Re: (Score:3, Funny)

        by ZinnHelden (1549931)
        Yeah, I may hear their insane whispering, but I'm not giving up my Citadel server.
      • by goltzc (1284524)
        Don't portions of SharePoint use webdav and ntlm authentication?
        • by lukas84 (912874)

          Yes, of course.

          But publishing Sharepoint directly to the Internet is insane. You should put an ALG in front of it, for example ISA Server.

        • Both are fairly fundamental parts of SharePoint for the integration features, but you would never expose either to the world when using an external facing SharePoint deployment. Also your SharePoint server should be behind an application aware firewall such as ISA Server anyway.
        • As do some portions of Exchange. The GP was probably after some Funny mods, not informative.
      • by Ralish (775196)

        Funny. It sounded like "use software with open standards and secure implementations" to me.

        I personally use Apache for my web-facing server, but that being said, IIS 6 (Windows Server 2003) has had a very good security track record [secunia.com]. Secunia tracks 6 advisories since its release back in 2003 and only one of those is unpatched, that being the vulnerability this story is about.

        In contrast, Apache 2.2 was released in late 2005 and has 10 exploits listed [secunia.com], with 2 unpatched and 2 with partial fixes. The exploits seem to be on average less severe, but there's more of them, and some aren't patched.

  • since ~70% of the hits on a quick google are how to turn on and configure WebDAV. But this also means that there seems to be a good bit of interest in using it...
  • by jsnipy (913480) on Wednesday May 20, 2009 @08:13AM (#28024299) Journal
    This is really not a typically configuration for an outward facing site. Acting like this is some great find and "game over" scenario is a little far fetched. "Downplay" is flamebait in this context. But, it does make a good m$ bashing opportunity!
    • Re: (Score:1, Troll)

      Mayhaps it isn't a major bug, but this is exactly what Microsoft does every time. Downplay their bugs (and take their sweet time patching them), while bashing any high profile bugs that crop up in open source projects. I'd be more impressed if their response was "There's a bug in IIS, don't use feature X or configuration Y while we fix it."
    • "This is really not a typically configuration for an outward facing site"

      How do you know this, is IIS shiped by default with this 'safe' configuration?

      "the flaw is currently being exploited in online attacks, according to CERT", and according to theReg, Ball State University was hacked using this exact same exploit.

      'Shortly after the attack, students checking their iWeb pages were greeted with a message [slashdot.org] that said they had been hacked'
      • by Shados (741919)

        How do you know this, is IIS shiped by default with this 'safe' configuration?

        More so than that: not only is the feature not activated by default, its not even installed. And NTLM on a public facing web site means someone made the conscious decision of disabling anonymous and form authentication (as those would always kick in first, thus almost closing down NTLM access in the first place). If you have a firewall, the appropriate port may need to be opened, too, in some cases.

        It is not the default by any str

        • by rs232 (849320)
          "NTLM on a public facing web site means someone made the conscious decision of disabling anonymous and form authentication"

          You are confusing me, I thought NTLM was the authentication mechanism used by IIS, and what is IIS if not a web server. Is there any technical advisory that IIS shouldn't be used on a public facing web site? and also .. did the admins at Ball State University disable anonymous and form authentication?
          • by Shados (741919)

            NTLM is the basic form of Windows Authentication, which is used when integrated authentication is needed, but Kerberos would be overkill. So its basically how you login to a windows box. Internet Explorer and some (but not all...though Firefox can) other browsers will let you use it for website authentication, but it rests that its a form of network authentication that is not optimized for public networks (it is most commonly used to authenticate users on an intranet so they don't have to enter their passwo

  • For more information (Score:3, Informative)

    by itayperl (1340879) on Wednesday May 20, 2009 @08:16AM (#28024337)
  • Nasa downplays ISS bug.
    • Re: (Score:3, Funny)

      by Ash-Fox (726320)

      Nasa downplays ISS bug.

      Fortunately they have got a Russian on board the space station.

      "This is how we fix things on Russian space station!" --Lev Andropov

      (He then proceeds to take a hammer and whack the equipment.)

  • by Twillerror (536681) on Wednesday May 20, 2009 @08:20AM (#28024363) Homepage Journal

    http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html [zoller.lu]

    Several news stories seem to allude that Microsoft is artificially downplaying the threat, citations of myself are used to underline the headline in an "us against Microsoft" kind of way. I want to clarify that I have the utmost respect of the MSRC team and I don't suspect Microsoft to willingly downplay anything. They also claim I am from Belgium, I am obviously from Luxembourg. The bug also is not the same as the IIS4/5 one, it's root cause is similar. That's about it.

    • They also claim I am from Belgium, I am obviously from Luxembourg.

      I used to work at a US office of a large French company, so I have some insights into this statement that might not be apparent to the typical American. Consider this as if he had said:
      They also claim I am from Alabama. I am obviously from Tennessee.
      and you'll have a rough idea of what he is saying and why he doesn't like it to be said that he's from Belgium.

      • But I'm from D.C., and live in NYC. So both Alabama and Tennessee sound like hick country to me! Can I get a different analogy?

        I'm half joking.

  • by geoffrobinson (109879) on Wednesday May 20, 2009 @08:22AM (#28024375) Homepage

    To Whom It May Be Concerned:

    Warner Bros., in an ill-advised attempt to promote Terminator Salvation, created a Skynet virus which aims to take over the world.

    For some reason, it targets IIS.

    We're doomed. Please head to the bomb shelter and the world will start again with a base of Microsoft employees.

    thank you,
    Management

    • Re: (Score:1, Troll)

      the world will start again with a base of Microsoft employees.

      Assuming they're allowed to reproduce - I've met several of them, and I don't think that's a safe assumption (unless they're interbreeding, but that might not produce viable offspring).

  • Serious question (Score:4, Interesting)

    by Ash-Fox (726320) on Wednesday May 20, 2009 @08:47AM (#28024643)

    Serious question, has the Apache package even had any bad vulnerabilities like this in the past ten years?

      • That query shows all results even tangentially related to Apache family. You need to look at the advisories for Apache 2.2 [secunia.com], Apache 2.0 [secunia.com], and Apache 1.3 [secunia.com] specifically.
        • Wow! [secunia.com] Using a 403 error page to make another server put bad code into the user's browser is genial. That is why I like security people, I'd never think about something lke that.
      • by AvitarX (172628)

        I see 541 advisories(many look like duplicates by distro at a glance), but I am NOT going to look for myself and see if any of them are major. That sounds like a lot of work.

      • Re: (Score:3, Informative)

        by dkleinsc (563838)

        For lazy people, about 3 vulnerabilities classified as "Highly" critical, 0 "Extremely", out of a total of around 50 across Apache 1, Apache 2.0.x, and Apache 2.2.x. Of the 50, the vast majority are at least partially fixed.

        It's hard to get a fix on equivalent numbers for IIS, since they all seem to fall under the MS Windows category.

    • Re:Serious question (Score:5, Interesting)

      by Twillerror (536681) on Wednesday May 20, 2009 @09:24AM (#28025071) Homepage Journal

      Serious answer. Apache is a modular beast and since doesn't get blaimed for modular problems like this.

      There have been issues even bigger in various mods like mod_php.

      Even code red was a problem with Internet printing and not really the core IIS. Maybe IIS should have blocked it and already had URLScan, but ultimately it was just passing a URL along some C++ code that blew up. MS created that .DLL so we can blame MS..but blaiming IIS itself was slightly off.

      The core of both IIS and Apache have been pretty well hardened. Hence why WebDav is turned off in IIS 6. Even .ASP has to be turned on during setup.

      MS puts out it's own mods essentially...where Apache would have a different team working on WebDAV. If the same "exploit" was found in mod_webdav who could we really blame. Yell at the Apache foundation...no we would professionally fix the issue. Maybe some flaimbaiters on the other side would yell..."see open source is less secure".

      Softwares has bugs, some of them are security related. When open source creates them they are presented as bugs...when MS creates them it is some kind of great conspiracy to rule the world. Some guy just like you wrote this bad code and is probably feeling like crap today. Some tester let it get thru and is feeling really crappy today. A bunch of dudes in at both MS and the rest of the security community are pulling up their britches and getting it fixed...move along nothing to really see here.

      • by Foofoobar (318279)
        Well the problem isn't just that one developer and tester let it through. They let it through TWICE! After the first time, you would have thought that they would have built a class/function/api to handle all URL's and do the cleaning automatically. That way any app sending URL's through the system could have them cleaned the same way so as to avoid an exploit.

        This constant lack of consistency is a Microsoft trademark where one hand doesn't know what the other hand is doing and as a result issues that the
      • by cl0s (1322587)

        Yea difference is, if I'm Big Company A using Apache and we find a bug/security flaw we can hire someone to fix it or call up apache or the mod creator and pay him to fix it immediately and patch our servers. Big Company B that uses IIS finds a bug and they can either turn the service off and wait for a fix to be released (which might not be an option depending on how critical that service is for the company) or just have to hope its not exploited while Microsoft patches it - whenever they feel like, depend

        • Re: (Score:1, Interesting)

          by Anonymous Coward

          Actually, if you're a big enough company you can get the same response from Microsoft. You call through their incident support line and get through to the project support lead for the product in question and they can manage putting together a hot fix. It will cost you, but it would cost you either way. I worked for a fairly small company five years ago and we got the lead developer from the Microsoft SNA division to create a custom patch for a bug that we identified on a Sunday morning at 2:00 AM. In al

      • by Jahava (946858)

        You posted good information and a nice perspective. I do agree with what you say, in spirit.

        However, let's not forget that neither Microsoft nor Apache, including their coders and contributers, is innocent. They're both competing in an arena to provide drop-in solutions that form a backbone of the most technologically-vast infrastructure in the world (the Internet). There's money to be had, and responsibility comes right alongside it. Your kind of thinking, while very empathetic, is dangerous, as we have to

  • by SlappyBastard (961143) on Wednesday May 20, 2009 @08:53AM (#28024705) Homepage

    Anyone using the exploit is prompted repeatedly about whether they really, really want to do it.

    Geez. Don't you people know anything about Windows security?

  • by spitzak (4019) on Wednesday May 20, 2009 @01:05PM (#28028581) Homepage

    It sounds like the basic cause is something attempting to translate a string into "unicode" before using it.

    For some reason, normally intelligent programmers turn into complete morons when presented with UTF-8 and other Unicode encodings. They become convinced that it is somehow physically impossible to do anything to these strings without first finding all the "characters" (actually Unicode code points, which are not "characters") and will write pages and pages of elaborate and bug-prone code to do this and "count characters". This code is COMPLICATED and there is the basic fact that the mapping is often not 1:1 and even when it is different implementations vary and thus don't invert correctly. This causes bugs, nasty ones like you can see right. here.

    In fact it would be trivial to just treat it as a string of bytes that happens to maybe represent some text. The ONLY time you need "characters" is when you are rendering the string into an image that humans will look at, and if you want to do semantic analysis such as grammar checking. It is not needed if you are looking for the period that starts the extension or trying to find a number.

    What is really sad and mysterious is that this disease only seems to be triggered by UTF-8. Nobody worries about finding the boundaries between "words". Nobody seems to worry about UTF-16 surrogate pairs, and nobody was really concerned with older Japanese multi-byte encodings.

    This is NOT Microsoft-specific so don't feel complacent. Microsoft's moronic decision to name files with UTF-16 is really bad, but witness open source Python 3.0 which has decided that all strings will have to be converted to "unicode" (acutally UTF-16 or UTF-32 depending on the platform) before anything is done to them. Python is heavily used to parse HTML and URLs and I expect a huge mess from this stupid idea.

    I'm sure there will be a few responses claiming some magical property of "characters" so that you can't do anything about it. PLEASE, try some thought experiments. Try substituting "words" in your example, it will either be stupid, or you will realize that that only a tiny portion of software needs it. Go and write some code where you leave the strings in UTF-8 and maybe you will learn.

This is clearly another case of too many mad scientists, and not enough hunchbacks.

Working...