OSVDB ID: 274

Title: Microsoft IIS ctss.idc ODBC Sample Arbitrary Command Execution

Info

Disclosure
Jul 31, 2001

Discovery
Unknown

Dates

Exploit
Jul 31, 2001

Solution
Unknown

Description

 Microsoft IIS contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the ctss.idc example file, which does not sanitize user-supplied input. It is possible that the flaw may allow arbitrary command execution resulting in a loss of integrity.

Classification

 Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

 Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: Remove the sample application from the web server.

Products

Microsoft Corporation

IIS

 3.0
4.0
5.0

References

Credit
  • H D Moore - fdlistBrand New Doo Doodigitaloffense.net - The Metasploit Project
  • César González - secBrand New Doo Doolinuxcantabria.sytes.net -


Direct URL: http://osvdb.org/36218