Microsoft Downplays IIS Bug Threat 114
snydeq writes "Microsoft confirmed that its IIS Web-server software contains a vulnerability that could let attackers steal data, but downplayed the threat, saying 'only a specific IIS configuration is at risk from this vulnerability.' The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."
'only a specific IIS configuration is at risk' (Score:5, Funny)
The default?
Re:'only a specific IIS configuration is at risk' (Score:5, Funny)
oblig (Score:5, Funny)
One that isn't installed.
Re: (Score:2)
Lalalala, I'm not listen(2)ing! ;-)
Re:'only a specific IIS configuration is at risk' (Score:5, Funny)
Did they give any configuration which is not at risk?
Yes. it's a hidden one, only attainable by those who see the Light. All hail fdisk!
Re:'only a specific IIS configuration is at risk' (Score:5, Informative)
Did they give any configuration which is not at risk?
Yes, several: More information about the IIS authentication bypass [technet.com]
Worth noting that this only affects IIS 5.x and 6.x, which admittedly, accounts for the huge majority of IIS webservers, but IIS 7.x (Windows Server 2008 and above) are not affected.
Re:'only a specific IIS configuration is at risk' (Score:5, Informative)
Only servers with WEBDAV installed are vulnerable. WEBDAV is not installed and configured by default.
Only IIS 5, 5.1 and 6 are potentially vulnerable under these conditions.
IIS 7 is not vulnerable even with WEBDAV installed.
Re:'only a specific IIS configuration is at risk' (Score:4, Funny)
Sounds like you could avoid it by not allowing Unicode either...
I mean, who really needs 'all' those characters?
Re: (Score:3, Funny)
I mean, who really needs 'all' those characters?
Here on slashdot, we only need one character: Anonymous Coward!
Re: (Score:2)
What about CowboyNeal?
Re:'only a specific IIS configuration is at risk' (Score:5, Informative)
IIRC, WebDAV *is* configured by default on IIS 5. Here's a link to instructions on disabling it (the procedure involves adding a registry value and restarting IIS):
Microsoft KB Article #241520 [microsoft.com]
Re: (Score:2)
Prolly is the default... Failure is not an option... it comes bundled with Windows. And the best fix for Windows... installing Ubuntu.
Re: (Score:1)
WebDAV used much? (Score:2, Interesting)
Re:WebDAV used much? (Score:5, Informative)
Yup. You need a fairly specific setup: WebDav enabled on the same application as NTLM authentication (kerberos and anonymous/form is ok as far as I understand), and there must not be anything on top of WebDev for authentication (such as one of the various single signon ISAPIs or a CMS exposing its content through webdav with some form of custom security schemes).
Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios. Don't get me wrong: that is severe, as most hacking DOES come from within.
What makes it far more major, is that its one of the extremely rare remotely exploitable vulnerability that IIS6 have had. Contrary to Slashdot beleif, IIS6 (IIS7 more so though) is totally rock solid and extremely secure, so having something like that pop up is quite scary.
Re: (Score:2, Insightful)
Since no one in their right mind will have WebDav and NTLM exposed to a public site
Have you ever worked in IT? Things "no one in their right mind" would do happen all the time. People don't want to remember 10 different passwords, so I can easily see people wanting to be able to update the website with their "windows password". I'm betting this configuration is far more common than you might think.
Re:WebDAV used much? (Score:5, Informative)
Since no one in their right mind will have WebDav and NTLM exposed to a public site
They will if they're running Outlook Web Access, and haven't manually disabled NTLM using a command-line vbscript that comes with IIS.
Re: (Score:1)
They will if they're running Outlook Web Access, and haven't manually disabled NTLM using a command-line vbscript that comes with IIS.
There is so much wrong with that statement... First if it is a vbscript, it isn't manual and it isn't command-line.
Also when using Windows Integrated Auth, Kerberos is the default authentication. If Kerberos fails, then it uses NTLM. Unless you can provide a link that says otherwise...
Re:WebDAV used much? (Score:5, Informative)
There is so much wrong with that statement... First if it is a vbscript, it isn't manual and it isn't command-line.
Do me a favour. Find your IIS root folder (C:\Inetpub by default). Go into the AdminScripts subfolder. Try double-clicking adsutil.vbs and see how well it works running as a GUI app instead of being called from the command line using cscript.
Also when using Windows Integrated Auth, Kerberos is the default authentication. If Kerberos fails, then it uses NTLM. Unless you can provide a link that says otherwise...
Kerberos is allowed by default, but so is NTLM. If you want to *disallow* NTLM, you have to do this using the script I mentioned above, and in my original post. The syntax is e.g.:
cscript -nologo adsutil.vbs SET w3svc/1/root/NTAuthenticationProviders "Negotiate"
Seems pretty manual to me. But what do I know?
PS: You can verify this on your IIS install using the GET version of that command. The default is "Negotiate,NTLM" (which is also true if it's not explicitly defined). Most IIS admins and engineers don't know how to do things like set up SPNs for Kerberos authentication, which I'm sure is why NTLM is allowed by default.
Re: (Score:3, Informative)
Note 1: see this Microsoft article [microsoft.com] for the official documentation.
Note 2: I suspect that "Negotiate" might actually mean "use the operating-system-level security configurations of the client and the server to determine which protocol is acceptable", so that in order to truly *force* Kerberos you might also have to disallow all varieties of NTLM in the security policy for the server. That's just a guess though.
Re: (Score:2)
To your other post, negotiate is referring to Kerberos. I don't know why the don't call it Kerberos, but it relies on *negotiating* some crap (I cant remember details right now) and then sending credentials. Confusing, yes.
Re: (Score:1)
"I'm right until you prove me wrong" ?
Re: (Score:2)
OWA doesn't use WebDav
i don't know anyone that uses WebDav..
the problem isn't in using NTLM (still not the best thing to do) but it is with WebDav
Re: (Score:2)
OWA doesn't use WebDav
It actually does, as I was most disappointed to discover a year or two ago. I don't have time to find official documentation on the MS website, but here's an example of some testing that was done against it [cookcomputing.com].
Re: (Score:2)
But it isn't required.. for that to work you have to allow webdav which isn't default.
you can still use webdav style searchs using exlodb.
OWA works fine with webdav blocked on iis6
Re:WebDAV used much? (Score:5, Informative)
The system-wide WebDAV isn't required. Exchange installs its own, separate WebDAV components, which are.
See:
http://support.microsoft.com/kb/309508/ [microsoft.com] ("Exchange 2000 components use Web Distributed Authoring and Versioning (WebDAV) and other Hypertext Transfer Protocol (HTTP) verbs that are not allowed by the default configuration [of the IIS Lockdown and URLScan tools].")
http://windowsitpro.com/article/articleid/38396/critical-webdav-vulnerability-are-your-exchange-servers-safe.html [windowsitpro.com] ("You can't disable WebDAV on your Exchange 2000 servers because OWA 2000 depends on WebDAV")
and
http://windowsitpro.com/article/articleid/45356/deciding-if-and-how-to-disable-webdav-access.html [windowsitpro.com] ("If you're trying to disable Exchange 2003's DAV implementation, be aware that Outlook Web Access (OWA) and several other Exchange components depend on DAV. By blocking specific DAV verbs at the network level (through a firewall) or by installing URLScan, you will break the Exchange DAV implementation."). This last article specifically mentions the separate DAV DLLs for Exchange.
Re: (Score:2)
Re: (Score:2)
But Exchange and Sharepoint exposed through webdav are not vulnerable to this exploit, only file systems are, and its a different ballpark altogether. As soon as there's some form of indirect authentication layer in between, instead of straight NTLM, it doesn't work anymore.
Re: (Score:2, Flamebait)
[...]
What makes it far more major, is that its one of the extremely rare remotely exploitable vulnerability that IIS6 have had. Contrary to Slashdot beleif, IIS6 (IIS7 more so though) is totally rock solid and extremely secure, so having something like that pop up is quite scary.
Contrary to Slashdot belief, Slashdotters usually rant about Microsoft client operating systems, like Vista or Win7. Ranting about Server Software is bad form, primarily because Linux/Apache is the primary platform, [netcraft.com] and Slashdot should therefore rant that Linux is nipping MS in the bud with its uncompetitive practices.
Re:WebDAV used much? (Score:4, Insightful)
Since no one in their right mind will have WebDav and NTLM exposed to a public site, then the "hackers" can only come from within in the vast majority of scenarios.
You're making the mistake of assuming that most IIS admins know what they're doing. I'm sure most of them think they know what they're doing, but I'm betting this flaw will get exploited from without much more often than you think it will.
Re: (Score:2)
I'm sure most of them think they know what they're doing
I'm not. The big selling point of IIS is that it's possible to install it and run it by just clicking on a simple GUI, so it can be run by people who don't really understand computers. A lot of 'IIS admins' are likely to be some guy who knows slightly more than anyone else in the company about computers but is really employed to do something else.
Re: (Score:3, Funny)
Reality just stood up and punched that misconception on the nose.
Re: (Score:1)
Re: (Score:2)
most [successful] hacking DOES come from within.
Edited for correctness. By far, the majority of attempts come from outside.
Re: (Score:2)
Yeah I realized that after I posted, that it could be taken as "attempt". Obviously, especially with all the script kiddies and bots, it mostly comes from the outside, but most of those are against patched vulnerabilities. Even in high profile companies like banks, there is a general feeling of "Who would hack us from the inside?! They wouldn't even know how!!!", without realizing how quickly the secretary will learn how to run a hacker's script if you piss her off on the wrong day.
Re: (Score:2)
Re: (Score:1)
Parent post has been trounced (doubly!) as a troll, and it certainly dripped sarcastic acid. But the question it posed does seem like a valid one:
Is there any equivalent configuration of Apache that would expose a similar vulnerability? That is, is this kind of vulnerability something that could possibly affect Mac, Linux, BSD, or Unix environments, or is it solely limited to Microsoft shops?
I haven't worked on MS-specific stuff for nearly a decade (except as needed to get MSIE to do what standards-comp
Re: (Score:2)
To be honest, this falls well within the "meh" category of problems. If you have WebDAV running, either you chose to turn it on for very specific reasons, and hopefully made an informed decision before you did so; or, you are running a decade old version of IIS on a decade old operating system and nev
Subliminal messaging (Score:2, Insightful)
'only a specific IIS configuration is at risk from this vulnerability.'
In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"
Re: (Score:3, Insightful)
In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"
Funny. It sounded like "use software with open standards and secure implementations" to me.
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:1)
Yes, of course.
But publishing Sharepoint directly to the Internet is insane. You should put an ALG in front of it, for example ISA Server.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Funny. It sounded like "use software with open standards and secure implementations" to me.
I personally use Apache for my web-facing server, but that being said, IIS 6 (Windows Server 2003) has had a very good security track record [secunia.com]. Secunia tracks 6 advisories since its release back in 2003 and only one of those is unpatched, that being the vulnerability this story is about.
In contrast, Apache 2.2 was released in late 2005 and has 10 exploits listed [secunia.com], with 2 unpatched and 2 with partial fixes. The exploits seem to be on average less severe, but there's more of them, and some aren't patched.
It deosn't seem to be default... (Score:1)
Not a typical configuration (Score:5, Informative)
Re: (Score:1, Troll)
Re: (Score:2)
Turning off WebDAV might be a good option if you are not using it or can live without out until we have a security update available. You can find instructions at http://support.microsoft.com/kb/241520 [microsoft.com].
Source: http://blogs.technet.com/srd/archive/2009/05/18/more-information-about-the-iis-authentication-bypass.aspx [technet.com]
Re: (Score:2)
"Turning off WebDAV might be a good option if you are not using it or can live without out until we have a security update available"
Of course, not turning it on to start with, if you don't use it or can live without it is out of consideration.
not a typically configuration (Score:2)
How do you know this, is IIS shiped by default with this 'safe' configuration?
"the flaw is currently being exploited in online attacks, according to CERT", and according to theReg, Ball State University was hacked using this exact same exploit.
'Shortly after the attack, students checking their iWeb pages were greeted with a message [slashdot.org] that said they had been hacked'
Re: (Score:2)
More so than that: not only is the feature not activated by default, its not even installed. And NTLM on a public facing web site means someone made the conscious decision of disabling anonymous and form authentication (as those would always kick in first, thus almost closing down NTLM access in the first place). If you have a firewall, the appropriate port may need to be opened, too, in some cases.
It is not the default by any str
Re: (Score:2)
You are confusing me, I thought NTLM was the authentication mechanism used by IIS, and what is IIS if not a web server. Is there any technical advisory that IIS shouldn't be used on a public facing web site? and also
Re: (Score:2)
NTLM is the basic form of Windows Authentication, which is used when integrated authentication is needed, but Kerberos would be overkill. So its basically how you login to a windows box. Internet Explorer and some (but not all...though Firefox can) other browsers will let you use it for website authentication, but it rests that its a form of network authentication that is not optimized for public networks (it is most commonly used to authenticate users on an intranet so they don't have to enter their passwo
Re: (Score:1, Offtopic)
edit: 4th :P
when will slashcode implement editing and Unicode?
For more information (Score:3, Informative)
ISS bug (Score:1)
Re: (Score:3, Funny)
The researcher nixes MS downplaying (Score:5, Informative)
http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html [zoller.lu]
Several news stories seem to allude that Microsoft is artificially downplaying the threat, citations of myself are used to underline the headline in an "us against Microsoft" kind of way. I want to clarify that I have the utmost respect of the MSRC team and I don't suspect Microsoft to willingly downplay anything. They also claim I am from Belgium, I am obviously from Luxembourg. The bug also is not the same as the IIS4/5 one, it's root cause is similar. That's about it.
Translation for American audiences ONLY (Score:2)
They also claim I am from Belgium, I am obviously from Luxembourg.
I used to work at a US office of a large French company, so I have some insights into this statement that might not be apparent to the typical American. Consider this as if he had said:
They also claim I am from Alabama. I am obviously from Tennessee.
and you'll have a rough idea of what he is saying and why he doesn't like it to be said that he's from Belgium.
Re: (Score:2)
But I'm from D.C., and live in NYC. So both Alabama and Tennessee sound like hick country to me! Can I get a different analogy?
I'm half joking.
Internal Memo (Score:5, Funny)
To Whom It May Be Concerned:
Warner Bros., in an ill-advised attempt to promote Terminator Salvation, created a Skynet virus which aims to take over the world.
For some reason, it targets IIS.
We're doomed. Please head to the bomb shelter and the world will start again with a base of Microsoft employees.
thank you,
Management
Re: (Score:1, Troll)
the world will start again with a base of Microsoft employees.
Assuming they're allowed to reproduce - I've met several of them, and I don't think that's a safe assumption (unless they're interbreeding, but that might not produce viable offspring).
Re: (Score:1)
While I'm glad they are setting this movie in the future, my enthusiasm has been diminished by the cancellation. Seriously, I need to make sure I don't get too attached to any show on that network.
Re: (Score:2)
Comment removed (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
I see 541 advisories(many look like duplicates by distro at a glance), but I am NOT going to look for myself and see if any of them are major. That sounds like a lot of work.
Re: (Score:3, Informative)
For lazy people, about 3 vulnerabilities classified as "Highly" critical, 0 "Extremely", out of a total of around 50 across Apache 1, Apache 2.0.x, and Apache 2.2.x. Of the 50, the vast majority are at least partially fixed.
It's hard to get a fix on equivalent numbers for IIS, since they all seem to fall under the MS Windows category.
Re: (Score:1)
It's hard to get a fix on equivalent numbers for IIS, since they all seem to fall under the MS Windows category.
its not hard at all. http://secunia.com/advisories/product/1438/ [secunia.com] http://secunia.com/advisories/product/17543/ [secunia.com]
Re:Serious question (Score:5, Interesting)
Serious answer. Apache is a modular beast and since doesn't get blaimed for modular problems like this.
There have been issues even bigger in various mods like mod_php.
Even code red was a problem with Internet printing and not really the core IIS. Maybe IIS should have blocked it and already had URLScan, but ultimately it was just passing a URL along some C++ code that blew up. MS created that .DLL so we can blame MS..but blaiming IIS itself was slightly off.
The core of both IIS and Apache have been pretty well hardened. Hence why WebDav is turned off in IIS 6. Even .ASP has to be turned on during setup.
MS puts out it's own mods essentially...where Apache would have a different team working on WebDAV. If the same "exploit" was found in mod_webdav who could we really blame. Yell at the Apache foundation...no we would professionally fix the issue. Maybe some flaimbaiters on the other side would yell..."see open source is less secure".
Softwares has bugs, some of them are security related. When open source creates them they are presented as bugs...when MS creates them it is some kind of great conspiracy to rule the world. Some guy just like you wrote this bad code and is probably feeling like crap today. Some tester let it get thru and is feeling really crappy today. A bunch of dudes in at both MS and the rest of the security community are pulling up their britches and getting it fixed...move along nothing to really see here.
Re: (Score:2)
This constant lack of consistency is a Microsoft trademark where one hand doesn't know what the other hand is doing and as a result issues that the
Re: (Score:1)
Yea difference is, if I'm Big Company A using Apache and we find a bug/security flaw we can hire someone to fix it or call up apache or the mod creator and pay him to fix it immediately and patch our servers. Big Company B that uses IIS finds a bug and they can either turn the service off and wait for a fix to be released (which might not be an option depending on how critical that service is for the company) or just have to hope its not exploited while Microsoft patches it - whenever they feel like, depend
Re: (Score:1, Interesting)
Actually, if you're a big enough company you can get the same response from Microsoft. You call through their incident support line and get through to the project support lead for the product in question and they can manage putting together a hot fix. It will cost you, but it would cost you either way. I worked for a fairly small company five years ago and we got the lead developer from the Microsoft SNA division to create a custom patch for a bug that we identified on a Sunday morning at 2:00 AM. In al
Re: (Score:1)
You posted good information and a nice perspective. I do agree with what you say, in spirit.
However, let's not forget that neither Microsoft nor Apache, including their coders and contributers, is innocent. They're both competing in an arena to provide drop-in solutions that form a backbone of the most technologically-vast infrastructure in the world (the Internet). There's money to be had, and responsibility comes right alongside it. Your kind of thinking, while very empathetic, is dangerous, as we have to
It's not a big deal (Score:5, Funny)
Anyone using the exploit is prompted repeatedly about whether they really, really want to do it.
Geez. Don't you people know anything about Windows security?
Re: (Score:2)
This is another Unicode hole (Score:3, Interesting)
It sounds like the basic cause is something attempting to translate a string into "unicode" before using it.
For some reason, normally intelligent programmers turn into complete morons when presented with UTF-8 and other Unicode encodings. They become convinced that it is somehow physically impossible to do anything to these strings without first finding all the "characters" (actually Unicode code points, which are not "characters") and will write pages and pages of elaborate and bug-prone code to do this and "count characters". This code is COMPLICATED and there is the basic fact that the mapping is often not 1:1 and even when it is different implementations vary and thus don't invert correctly. This causes bugs, nasty ones like you can see right. here.
In fact it would be trivial to just treat it as a string of bytes that happens to maybe represent some text. The ONLY time you need "characters" is when you are rendering the string into an image that humans will look at, and if you want to do semantic analysis such as grammar checking. It is not needed if you are looking for the period that starts the extension or trying to find a number.
What is really sad and mysterious is that this disease only seems to be triggered by UTF-8. Nobody worries about finding the boundaries between "words". Nobody seems to worry about UTF-16 surrogate pairs, and nobody was really concerned with older Japanese multi-byte encodings.
This is NOT Microsoft-specific so don't feel complacent. Microsoft's moronic decision to name files with UTF-16 is really bad, but witness open source Python 3.0 which has decided that all strings will have to be converted to "unicode" (acutally UTF-16 or UTF-32 depending on the platform) before anything is done to them. Python is heavily used to parse HTML and URLs and I expect a huge mess from this stupid idea.
I'm sure there will be a few responses claiming some magical property of "characters" so that you can't do anything about it. PLEASE, try some thought experiments. Try substituting "words" in your example, it will either be stupid, or you will realize that that only a tiny portion of software needs it. Go and write some code where you leave the strings in UTF-8 and maybe you will learn.
Re: (Score:3, Insightful)
Anything Microsoft related on Slashdot forums is automatically flamebait because of the emotional reactions the mere word 'Microsoft' triggers in so many Slashdotters which makes it unpossible to have a proper serious, well thought out debate. Just look at the replies it's getting. It's pathetic huh.
Re: (Score:1, Funny)
Re: (Score:2)
What, because emotional hysteria is the necessary defence for Microsoft's evils in the world? If we aren't angry and if we don't hate, then MS wins???
Re: (Score:2)
(Disclaimer: I love Linux and have been using it at home for years, but I'm sure as hell not going to go around and tell everyone that it's rock solid and bug free just because it's open and I like it.)
Re: (Score:2)
This attitude (open implies better) is what I call faith based IT.
Re: (Score:1)
Re: (Score:2)
Really? What's your evidence for that statement?