Signature Detail

HTTP: IIS HTR/ASP Chunked Encoding Vulnerability

This signature detects attempts to exploit a known vulnerability against the chunked encoding transfer mechanism in Microsoft IIS 4.0 and 5.0. Attackers can send a maliciously crafted HTTP request for an ASP or HTR page to execute arbitrary commands with system privileges.

Extended Description

A heap overflow condition in the 'chunked encoding transfer mechanism' related to the ISAPI HTR extension has been discovered in Microsoft IIS (Internet Information Services). This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.

Affected Products

• Microsoft iis 4.0
• Microsoft iis 5.0
• Microsoft windows_2000_advanced_server SP1
• Microsoft windows_2000_advanced_server SP2
• Microsoft windows_2000_advanced_server
• Microsoft windows_2000_datacenter_server SP1
• Microsoft windows_2000_datacenter_server SP2
• Microsoft windows_2000_datacenter_server
• Microsoft windows_2000_professional SP1
• Microsoft windows_2000_professional SP2
• Microsoft windows_2000_professional
• Microsoft windows_2000_server SP1
• Microsoft windows_2000_server SP2
• Microsoft windows_2000_server
• Microsoft windows_2000_terminal_services SP1
• Microsoft windows_2000_terminal_services SP2
• Microsoft windows_2000_terminal_services
• Microsoft windows_nt_enterprise_server 4.0
• Microsoft windows_nt_enterprise_server 4.0 SP1
• Microsoft windows_nt_enterprise_server 4.0 SP2
• Microsoft windows_nt_enterprise_server 4.0 SP3
• Microsoft windows_nt_enterprise_server 4.0 SP4
• Microsoft windows_nt_enterprise_server 4.0 SP5
• Microsoft windows_nt_enterprise_server 4.0 SP6
• Microsoft windows_nt_enterprise_server 4.0 SP6a
• Microsoft windows_nt_server 4.0
• Microsoft windows_nt_server 4.0 SP1
• Microsoft windows_nt_server 4.0 SP2
• Microsoft windows_nt_server 4.0 SP3
• Microsoft windows_nt_server 4.0 SP4
• Microsoft windows_nt_server 4.0 SP5
• Microsoft windows_nt_server 4.0 SP6
• Microsoft windows_nt_server 4.0 SP6a
• Microsoft windows_nt_terminal_server 4.0
• Microsoft windows_nt_terminal_server 4.0 SP1
• Microsoft windows_nt_terminal_server 4.0 SP2
• Microsoft windows_nt_terminal_server 4.0 SP3
• Microsoft windows_nt_terminal_server 4.0 SP4
• Microsoft windows_nt_terminal_server 4.0 SP5
• Microsoft windows_nt_terminal_server 4.0 SP6
• Microsoft windows_nt_workstation 4.0
• Microsoft windows_nt_workstation 4.0 SP1
• Microsoft windows_nt_workstation 4.0 SP2
• Microsoft windows_nt_workstation 4.0 SP3
• Microsoft windows_nt_workstation 4.0 SP4
• Microsoft windows_nt_workstation 4.0 SP5
• Microsoft windows_nt_workstation 4.0 SP6
• Microsoft windows_nt_workstation 4.0 SP6a

References

• BugTraq: 4855
• CVE: CVE-2008-0075
• CVE: CVE-2002-0364