iiscmd

Vulnerability Description

Brief description: If the Microsoft JET OLE DB Provider or Microsoft DataShape Provider are installed with IIS, a remote user could use the shell() Visual Basic command on the server to run arbitrary commands with administrator level privileges on the target host.

Full description: Microsoft JET OLE DB Provider or Microsoft DataShape Provider invoke JET 3.5, which allows calls to VBA's shell() function, which lets the user run shell commands (see RFP9901: NT ODBC remote vulnerabilities . IIS 4.0, by default, installs MDAC 1.5. This includes RDS, which allows for remote access to ODBC components over the web, through a .DLL located at /msadc/msadcs.dll (see RFP9902: RDS/IIS vulnerability and exploit ).

Components: Microsoft IIS 4.0 (trusted), Microsoft IIS 3.0 (trusted), Microsoft Index Server 2.0 (trusted), Microsoft MDAC 2.1UPGRADE (trusted), Microsoft MDAC 2.1CLEAN (trusted), Microsoft MDAC 2.0 (trusted), Microsoft MDAC 1.5 (trusted), Microsoft Site Server 3.0 (trusted)

Systems: Microsoft Windows NT 4.0 (trusted)

Effect(s) of exploiting: Attackers can execute arbitrary commands as administrator.

Detecting the hole:

Fixing the hole:

1. If you have MDAC 1.5 or 2.x installed on the IIS server and do not need MDAC functionality, perform the following:
   1. Delete the /msdac virtual directory in IIS, or
   2. Remove the following registry keys and all of their subkeys on the IIS server: RDSServer.DataFactory, AdvancedDataFactory, and VbBusObj.VbBusObjCls.
2. If you need MDAC capabilties:
   1. Install the latest version of MDAC 2.1.2.4202.3 (GA) (also known as MDAC 2.1 SP2)
   2. Disable anonymous access to the /msdac virtual directory
   3. Create a Custom Handler to filter incoming requests. More information on this is available from Microsoft .
   4. Remove all sample pages.

Other information:

Keywords

Cataloguing

PA Classification(s):

RISOS Classification(s):

DCS Classification(s):

CVE Number: CVE-1999-0233 -- IIS allows users to execute arbitrary commands using .bat or .cmd files.

Exploit Information

Attack: Rain Forest Puppy's msadc.pl exploit .

Related Information

Advisories: Security Focus database entry 529 ; RFP labs Advisory RFP9907 ; ISS X-Force http-iis-cmd ; Microsoft knowledge base articles Internet Information Server Security .CMD /.BAT Patch and IIS Security Concern Using Batch Files for CGI

Related Vulnerabilities:

Reportage

Reporting: Microsoft in Microsoft Security Bulletin MS98-004 (July 14, 1998 )

Revision Number 1

1. Homer Briggs (6/26/2000):
   Created entry