bugtraq - IIS 5.1 allows for remote viewing of source code on FAT/FAT32 volumes using WebDAV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 4 Sep 2005 00:22:27 -0000
From: inge.henriksen@...leansoft.com
To: bugtraq@...urityfocus.com
Subject: IIS 5.1 allows for remote viewing of source code on FAT/FAT32
 volumes using WebDAV

** Inge Henriksen Security Advisory - Full Disclosure Proof of Concept at http://ingehenriksen.blogspot.com/ **

It is possible to remotely view the source code of web script files though a specially 
crafted WebDAV HTTP request. Only IIS 5.1 seems to be vulnerable. The web script file 
must be on a FAT or a FAT32 volume, web scripts located on a NTFS are not vulnerable. 

Confirmed vulnerable:
-Microsoft® Internet Information Server® V5.1: 
  a. Microsoft® Windows® XP Pro. with SP2(English) 
  b. Microsoft® Windows® XP Pro. with SP2(Norwegian) 
  c. Microsoft® Windows® XP Pro. with SP1(Swedish) 

Confimed not vulnerable:
-Microsoft® Internet Information Server® V5.0: 
  a. Microsoft® Windows® 2000 Server with SP4(English) 
-Microsoft® Internet Information Server® V6.0: 
  a. Microsoft® Windows® 2003 Standard(English) 

Vendor status:
Notified

Solution:
Don't use FAT or FAT32 volumes with IIS 5.1.

Techical description:
WebDAV allows for retrieving streams using the "Translate: f" HTTP header, the processing
of this header has logic built into it so that web script files are not processed, this
logic can be avoided by using Unicode characters instead in one of the letters of the file.
The file must be on a FAT or FAT32 volume to be viewed, a NTFS volume will return a
"Forbidden" HTTP response instead.

Full Disclosure Proof of Concept at http://ingehenriksen.blogspot.com/