full-disclosure - Goatse Security Emergency Update! Microsoft IIS Directory Traversal Vulnerability! Do you know where your children are?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 22 Jun 2011 16:14:55 +0000
From: DiKKy Heartiez <dikkyheartiez@...mail.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Goatse Security Emergency Update! Microsoft IIS
 Directory Traversal Vulnerability! Do you know where your children are?

Goatse Security researchers have discovered a new vulnerability spreading in Microsoft's IIS products.
SynopsisBy using specially crafted URLs (uniform resource locators), an attacker can run commands and arbitrary code on a remote machine.
ExploitBy using the unicode equivalent of the "/" character (%c0%af) in a URL (or double-encoding part of the "../" string), directory traversal outside the document root is possible, and arbitrary commands can be passed to the cmd.exe interpreter for execution.  For example:
http://xx.xx.xx.xx/scripts/..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+echo+OWNED+BY+LULZSEC!+>+c:\inetpub\wwwroot\default.asp
Affected productsMicrosoft IIS versions 4.0-5.0 
StatusThis exploit is being used by expert hacking groups such as Anonymous, LulzSec, and the Phone Losers of America, as well as Turkish and Iranian individuals.  There are also scattered reports of a worm dubbed Code Red that makes use of this exploit.
VendorMicrosoft has been contacted repeatedly by Goatse Security but has failed to respond.
SolutionGoatse Security recommends the use of Symantec's Norton 360, the all-in-one security service that protects you, your PC, and your data from today's internet threats. 		 	   		  
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/