Microsoft IIS contains a flaw that allows a remote attacker to execute arbitrary code on a vulnerable server. The issue is due to the .printer ISAPI (Internet Services Application Programming Interface) Internet Printing Protocol (IPP) filter, handled by \WINNT\System32\msw3prt.dll, containing a buffer overflow. When a buffer of 420 bytes is sent within the HTTP Host: header of a .printer ISAPI request, the buffer is overflowed allowing the attacker to overwrite the EIP register and execute arbitrary code with SYSTEM access.

Currently, there are no known workarounds or upgrades to correct this issue.
However, Microsoft has released a patch (MS01-023) to address this vulnerability.

• CVE ID: 2001-0241 (see also: NVD)
• Milw0rm: 266 268
• Exploit Database: 266 268
• Bugtraq ID: 2674
• Metasploit ID: 3323
• CERT VU: 516648
• ISS X-Force ID: 6485
• CERT: CA-2001-10
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2001-05/0006.html
  http://archives.neohapsis.com/archives/bugtraq/2001-05/0024.html
  http://archives.neohapsis.com/archives/bugtraq/2001-05/0088.html
• Generic Exploit URL: http://immunitysec.com
  http://www.saintcorporation.com/cgi-bin/exploit_info/iis_printer_isapi
• Other Advisory URL: http://research.eeye.com/html/advisories/published/AD20010501.html
  http://www.eeye.com/html/Research/Advisories/AD20010501.html [ Link is 404 ]
  http://www.iss.net/xforce/alerts/id/advise75
  http://www.nipc.gov/warnings/advisories/2001/01-011.htm
• CIAC Advisory: l-078
• Microsoft Security Bulletin: MS01-023
• Keyword: msw3prt.dll NULL.printer
• Microsoft Knowledge Base Article: Q296576

• Riley Hassell - eEye Digital Security
• Ryan Permeh - eEye Digital Security