Microsoft recently issued a security advisory about an
authentication bypass vulnerability in certain Microsoft Internet
Information Services configurations.
The company said it's investigating reports of a vulnerability
that could allow privilege elevation but that it isn't aware of any
attacks that have attempted to exploit this vulnerability.
Microsoft's most current IIS software, IIS 7.0 in Windows Server
2008, is not affected.
The problem has to do with the way the WebDAV extension for IIS
processes HTTP requests. Using a maliciously crafted HTTP request,
the attacker could gain access to a directory that normally
requires authentication.
Jonathan Ness, an engineer with the Microsoft Security Response
Center, characterizes the risk as primarily one of information
disclosure.
"[T]he most likely attack would be a malicious anonymous user
requesting contents of a Web server subdirectory that uses IIS
permission restricting access to only authenticated users," he
explains in a blog post. "The root of the Web server would
typically grant read access to the anonymous user account so this
vulnerability would allow the protected subdirectories to be
accessed using the permissions of the Web server root (allowing
anonymous access)."
A number of factors mitigate the severity of the
vulnerability:
- The file system's access control list remains in place, so an
attacker who managed to access a system using the vulnerability
would still be limited by ACL permissions for an anonymous user
account.
- Anonymous user accounts are limited to read-only access by
default. So unless an administrator has overridden this setting, an
attacker would not have the ability to write files.
- WebDAV is not enabled by default on Windows Server 2003 systems
running IIS 6.0.
IIS users most at risk are those running IIS 5, 5.1, or 6.0 with
WebDAV enabled, using IIS permissions to restrict access to a
subdirectory that's inside a directory allowing anonymous access,
and who have granted file system access to the anonymous user
account.