Symantec™ Security Gateways Reference Guide - Sawmill

382 IDS eventsSuspicious activityHTTP IIS ASP ShowcodeBase Event:Details:Response:HTTP_SHOWCODE_ASP_ACCESSA sample Active Server Page (ASP) script, installed by default on Microsoft Internet InformationServer (IIS) 4.0, gives the remote users access to view any file, which is readable by the Web server,on the same volume as the Web server.IIS 4.0 installs some sample ASP scripts, including one called, “showcode.asp.” This script letsclients view the source of other sample scripts by means of a browser. The “showcode.asp” scriptdoes not perform sufficient checks and allows the files outside the sample directory to berequested. In particular, it does not check for “..” in the path of the requested file.The script takes one parameter, “source”, which is the file to view. The script’s default location URLis: http://www.sitename.com/msadc/Samples/SELECTOR/showcode.aspSimilar vulnerabilities have been noted in ViewCode.asp, CodeBrws.asp and Winmsdp.exe.Do not install the sample code on the production servers. If you have installed the sample code,remove it or install the patches.Affected: Microsoft IIS 4.0Microsoft IIS 4.0alphaMicrosoft Site Server 3.0alphaMicrosoft Site Server 3.0i386Microsoft Site Server 3.0SP1 alphaMicrosoft Site Server 3.0SP1 i386Microsoft Site Server 3.0SP2 alphaMicrosoft Site Server 3.0SP2 i386Microsoft Site Server Commerce Edition 3.0alphaMicrosoft Site Server Commerce Edition 3.0i386Microsoft Site Server Commerce Edition 3.0SP1 alphaMicrosoft Site Server Commerce Edition 3.0SP1 i386Microsoft Site Server Commerce Edition 3.0SP2 alphaMicrosoft Site Server Commerce Edition 3.0SP2 i386False Positives: None known.References Security Focus BID: 167Q231368: Solution Available for File Viewers VulnerabilityQ231656: Preventing ViewCode.asp from Viewing Known Server FilesHTTP IIS CGI NewdsnBase Event:Details:Response:HTTP_NEWDSN_EXE_ACCESSMicrosoft IIS 3.0 was delivered with a sample program, newdsn.exe, installed by default in thedirectory, wwwroot/scripts/tools/. Executing this program with a properly submitted URL couldallow for remote file creation. The created file is a Microsoft Access Database, but can have anyextension, including .html.Currently, the Security Focus staff is not aware of any vendor-supplied patches for this issue. If youfeel we are in error, contact us at: vuldb@securityfocus.com.