Symantec™ Security Gateways Reference Guide - Sawmill

316 IDS eventsIntrusion attemptsHTTP IIS CMDExecution AccessBase Event:Details:Response:HTTP_IIS_CMDEXECUTION_ACCESSWhen Microsoft IIS receives a valid request for an executable file, the filename is then passed to theunderlying operating system, which executes the file. In the event IIS receives a specially formedrequest for an executable file, followed by the operating system commands, IIS will proceed toprocess the entire string rather than reject it.Therefore, a malicious user may perform system commands through cmd.exe under the context ofthe IUSR_machinename account, which could possibly lead to privilege escalation, deletion,addition, file modification, or a full compromise of the server.To establish successful exploitation, the requested file must be an existing .bat or .cmd file residingin a folder for which the user possesses executable permissions.November 27, 2000 Update: Georgi Guninski has discovered new variants of this vulnerability thathave appeared after applying the patch Q277873, supplied by Microsoft.December 7, 2000 Update: Billy Nothern has discovered that the commands can also be parsedthrough ActiveState Perl.UPDATE: We believe that an aggressive worm may be in the wild that actively exploits thisvulnerability.Microsoft has released patches that eliminate the vulnerability. They also rectify the vulnerabilitydescribed in: MS00-086).This patch does not address the new variants discovered by Georgi Guninski on November 27,2000.After resolving the issue, try:■■Permitting access for trusted users only.Dedicating a separate drive or volume for published content.Affected: Microsoft IIS 4.0Microsoft IIS 5.0False Positives: None known.References: Security Focus BID: 1912CVE-2001-0886Microsoft Security Bulletin: MS01-086HTTP Infosearch AccessBase Event:Details:Response:Affected:HTTP_URL_SIG11The string “infosrch.cgi” was detected in an URL request. There is a known vulnerability associatedwith this file which may allow the sender of the request to access files on the Web server host asuser “nobody”.Location and audit of client and server is recommended.No specific targets.False Positives: None known.References:CVE-2000-0207http://www.whitehats.com (arachNIDS #290)HTTP Specifications