Overview
A vulnerability in the NNTP component of Microsoft IIS may allow a remote attacker to compromise the affected system.
Description
The Network News Transport Protocol (NNTP) is a protocol for the distribution, inquiry, retrieval, and posting of news articles over a network. Microsoft's Internet Information Services (IIS) provides support for a number of protocols, including NNTP. In addition to the original protocol specification in IETF RFC977, a number of standard extensions to NNTP are specified in RFC2980. One of these, the XPAT command, is used to retrieve specific headers from specific articles, based on pattern matching on the contents of the header. Several related flaws exist in the way the NNTP component handles the parsing and translation of user-supplied search patterns. These flaws result in a vulnerability that could be exploited by an attacker with the ability to send a specially crafted message to the affected server. |
Impact
A remote unauthenticated attacker may be able to execute code of their choosing with administrative privileges on the affected system. |
Solution
Apply a patch from the vendor Microsoft has published Microsoft Security Bulletin MS04-036 in response to this issue. Users are strongly encouraged to review this bulletin and apply the patches it refers to. |
Workarounds
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 0 | AV:--/AC:--/Au:--/C:--/I:--/A:-- |
| Temporal | 0 | E:ND/RL:ND/RC:ND |
| Environmental | 0 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to Lucas Lavarello and Juliano Rizzo of Core Security Technologies for reporting this issue.
This document was written by Chad R Dougherty based on information provided by Microsoft and Core Security Technologies.
Other Information
| CVE IDs: | CVE-2004-0574 |
| Severity Metric: | 30.06 |
| Date Public: | 2004-10-12 |
| Date First Published: | 2004-10-21 |
| Date Last Updated: | 2004-10-22 13:47 UTC |
| Document Revision: | 15 |