HTTP: Microsoft W3Who Buffer Overflow

This signature detects attempts to exploit a known vulnerability against the Microsoft W3Who Internet server application Dynamic-Link library. Attackers can remotely send a long string to overflow a buffer and execute malicious code on the server.

Extended Description

The Microsoft Windows 2000 Resource Kit supports many utilities designed for diagnostic administration of the Windows platform. The w3who.dll library is a utility designed to provide auditing of server configuration remotely through a Web browser. Multiple remote vulnerabilities affect the w3who.dll library of Microsoft's Windows Resource Kit. These issues are due to a failure of the library to properly sanitize and perform proper bounds checking on user-supplied input. The first two issues are cross-site scripting vulnerabilities. The final issue is a buffer overflow vulnerability. These issues may be exploited to conduct cross-site scripting attacks and execute arbitrary code with the privileges of the affected Web server. This may facilitate theft of cookie based authentication credentials, unauthorized access, privileges escalation other attacks.

Affected Products

Microsoft w3who.dll

References

BugTraq: 11820

CVE: CVE-2004-1134

URL: http://securitytracker.com/alerts/2004/Dec/1012435.html http://www.securiteam.com/windowsntfocus/6X00220C0K.html http://secunia.com/product/4361

Short Name

HTTP:OVERFLOW:MS-W3WHO-OF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft W3Who Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?