CIA RESEARCH

Alerts

[CIA-1031-Alert] IIS 5.x/6.x Server Name Spoofing results in Source Disclosure

Summary:

Internet Information Server 5.x and 6.x may reveal potentially sensitive information to a remote user who requests a resource with a specially-crafted HTTP request.

Technical Details:

The ASP error routines for Internet Information Server fail to properly validate the SERVER_NAME parameter within HTTP requests, and as a result, will provide error and debugging information of a potentially sensitive nature. Ordinarily this additional information is reserved for requests that originate from the loopback address, but IIS can be tricked into believing that any HTTP request originates from the localhost. A remote attacker can therefore obtain access to enhanced ASP debug information, and as well as fragments of ASP source code. Obtaining this information could allow an attacker to compromise a server, in the event that the code fragments contained passwords or disclosed other credentials.

Solution:

Contact the vendor for an available hotfix or workaround.

CVE Reference:

GENERIC-MAP-NOMATCH

SecurityTracker Number(s):

1014777

Vendor URL:

www.microsoft.com

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic’s research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing — that’s what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic’s customers are currently in the financial services and
e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC