lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 19 Apr 2014 11:22:49 +0800
From: YiFei Yang <>
To: "" <>
Subject: Re: [FD] iis cgi 0day

Confirmed working, however it can only overwrite environment variables
whose name is all capital, you can't overwrite Path.

So, you can overwrite CONTENT_LENGTH, which may trigger buffer overflow in
some applications that depends on this variable to allocate buffer, or have
the application allocating a huge amount of memory.
And HTTPS/REMOTE_ADDR/REMOTE_HOST, which might trick some apps to lower
their security level like allowing plaintext authentication since you're
using HTTPS, or even bypassing auth altogether since it thinks the remote
host is trusted.
Or overwrite PATHEXT to put .CMD/.BAT/.VBS etc. before .EXE
Or, PATH_TRANSLATED, so that you can have the CGI program read anything you
want as its input, as long as the account running it have sufficient

Anyway, there's a lot of possible ways of exploiting this.

'\n' must be present in the header name for this to work, like this:
junk=whatever\nEnvironment-Variable: Something

Which becomes 2 seperate environment variables like this:

And this:
junk\nEnvironment-Variable: Something

Gets turned into this:

If, for whatever reason, you really have to stick to Windows 2000+IIS 5,
have an IDS/IPS and configure a rule to detect '\n' in the HTTP header name
may help.

Otherwise, time to upgrade.

2014-04-19 4:15 GMT+08:00 Homer Parker <>:

> On Wed, 2014-04-16 at 12:25 +0200, Reindl Harald wrote:
> > Am 16.04.2014 08:39, schrieb Davide Davini:
> > > YiFei Yang wrote:
> > >> It is a bug affecting IIS4/5 using CGI on Windows NT/2000. Microsoft
> is
> > >> aware of it and won't fix it.
> > >
> > > Is there any workaround this bug? I might be slow but I can't find any
> >
> > just don't use unsupported OS versions if you care about
> > security - i know people even forgot NT/2000 existed
>         Oh?
> <
> >
> --
> Homer Parker <>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> Web Archives & RSS:

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists