Title: Microsoft IIS Out Of Process Privilege Escalation Vulnerability
Severity: HIGH
Description:
Microsoft IIS (Internet Information Services) is vulnerable to a privilege elevation vulnerability.
IIS can be configured to run applications either 'in process' or 'out of process'. The vulnerability is due to the way applications are executed when IIS is configured to run applications out of process. By default, IIS 5.0 and 5.1 run applications out of process for increased stability and security. Applications executed out of process will be executed within the security context of the IWAM_computername account.
When IIS is configured to run out of process, .asp requests and ISAPI dlls are executed within the dllhost.exe process. The dllhost.exe process uses CoImpersonateClient in order to obtain an impersonation token for the SYSTEM account in order to process the request. It then uses a RevertToSelf call in order to return to IWAM_computername privilege level.
It is possible for an attacker to manipulate the dllhost.exe memory space while it is running with IWAM_computername privilege. This could cause dllhost.exe to execute attacker supplied code when it impersonates SYSTEM privileges.
It should be noted that exploitation is possible only when an attacker has write and execute permissions on Web directories.
This vulnerability was originally described in BugTraq ID 6068. It is now being assigned its own BugTraq ID.
Affected Products:
- Cisco Building Broadband Service Manager 5.0.0
- Cisco Call Manager 1.0.0
- Cisco Call Manager 2.0.0
- Cisco Call Manager 3.0.0
- Cisco ICS 7750
- Cisco IP/VC 3540 Video Rate Matching Module
- Cisco Unity Server 2.0.0
- Cisco Unity Server 2.2.0
- Cisco Unity Server 2.3.0
- Cisco Unity Server 2.4.0
- Cisco uOne 1.0.0
- Cisco uOne 2.0.0
- Cisco uOne 3.0.0
- Cisco uOne 4.0.0
- Microsoft BackOffice 4.0
- Microsoft BackOffice 4.5
- Microsoft IIS 4.0
- Microsoft IIS 5.0
- Microsoft IIS 5.1
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server
- Microsoft Windows NT 4.0 Option Pack
- Microsoft Windows XP 64-bit Edition
- Microsoft Windows XP 64-bit Edition SP1
- Microsoft Windows XP Professional
- Microsoft Windows XP Professional SP1
References:
- Microsoft: Microsoft Security Bulletin MS02-062
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
