Vulnerabilities > CVE-2010-1899 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Microsoft products
Summary
Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability." Per: http://www.microsoft.com/technet/security/Bulletin/MS10-065.mspx 'ASP pages are prohibited by default on IIS 6.0. - The vulnerability is only exploitable when the ASP script writes parameters from the request in the response.'
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 2 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Exploit-Db
description | Microsoft IIS 6.0 ASP Stack Overflow (Stack Exhaustion) Denial of Service (MS10-065). CVE-2010-1899. Dos exploit for windows platform |
id | EDB-ID:15167 |
last seen | 2016-02-01 |
modified | 2010-10-01 |
published | 2010-10-01 |
reporter | kingcope |
source | https://www.exploit-db.com/download/15167/ |
title | Microsoft IIS 6.0 ASP Stack Overflow Stack Exhaustion Denial of Service MS10-065 |
Metasploit
description | The vulnerability allows remote unauthenticated attackers to force the IIS server to become unresponsive until the IIS service is restarted manually by the administrator. Required is that Active Server Pages are hosted by the IIS and that an ASP script reads out a Post Form value. |
id | MSF:AUXILIARY/DOS/WINDOWS/HTTP/MS10_065_II6_ASP_DOS |
last seen | 2020-04-11 |
modified | 2017-07-24 |
published | 2010-11-24 |
references | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1899 |
reporter | Rapid7 |
source | https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/dos/windows/http/ms10_065_ii6_asp_dos.rb |
title | Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service |
Msbulletin
bulletin_id | MS10-065 |
bulletin_url | |
date | 2010-09-14T00:00:00 |
impact | Remote Code Execution |
knowledgebase_id | 2267960 |
knowledgebase_url | |
severity | Important |
title | Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution |
Nessus
NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS10-065.NASL description The version of IIS installed on the remote host has the following vulnerabilities : - Sending a specially crafted request for an ASP page on a website hosted by IIS can result in a denial of service. (CVE-2010-1899) - Sending a specially crafted HTTP request to an IIS server with FastCGI enabled can result in remote code execution. (CVE-2010-2730) - Sending a specially crafted request to an IIS server running on Windows XP can allow a remote attacker to bypass the need to authenticate to access restricted resources. (CVE-2010-2731) last seen 2020-06-01 modified 2020-06-02 plugin id 49223 published 2010-09-14 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/49223 title MS10-065: Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(49223); script_version("1.28"); script_cvs_date("Date: 2018/11/15 20:50:30"); script_cve_id("CVE-2010-1899", "CVE-2010-2730", "CVE-2010-2731"); script_bugtraq_id(41314, 43138, 43140); script_xref(name:"IAVA", value:"2010-A-0120"); script_xref(name:"MSFT", value:"MS10-065"); script_xref(name:"MSKB", value:"2124261"); script_xref(name:"MSKB", value:"2271195"); script_xref(name:"MSKB", value:"2290570"); script_name(english:"MS10-065: Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960)"); script_summary(english:"Checks versions of Asp.dll / Cgi.dll / Infocomm.dll"); script_set_attribute( attribute:"synopsis", value:"The remote web server may allow remote code execution." ); script_set_attribute( attribute:"description", value: "The version of IIS installed on the remote host has the following vulnerabilities : - Sending a specially crafted request for an ASP page on a website hosted by IIS can result in a denial of service. (CVE-2010-1899) - Sending a specially crafted HTTP request to an IIS server with FastCGI enabled can result in remote code execution. (CVE-2010-2730) - Sending a specially crafted request to an IIS server running on Windows XP can allow a remote attacker to bypass the need to authenticate to access restricted resources. (CVE-2010-2731)" ); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-065"); script_set_attribute( attribute:"solution", value: "Microsoft has released a set of patches for IIS on Windows XP, 2003, Vista, 2008, 7, and 2008 R2." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/07/02"); script_set_attribute(attribute:"patch_publication_date", value:"2010/09/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/09/14"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc."); script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, 'Host/patch_management_checks'); exit(0); } include("audit.inc"); include("smb_func.inc"); include("smb_hotfixes.inc"); include("smb_hotfixes_fcheck.inc"); include("misc_func.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS10-065'; kbs = make_list("2124261", "2271195", "2290570"); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING); get_kb_item_or_exit("SMB/Registry/Enumerated"); get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1); if (hotfix_check_sp_range(xp:'3', win2003:'2', vista:'1,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN); if (hotfix_check_iis_installed() <= 0) audit(AUDIT_NOT_INST, "IIS"); rootfile = hotfix_get_systemroot(); if (!rootfile) exit(1, "Failed to get the system root."); share = hotfix_path2share(path:rootfile); if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share); if ( # Windows 7 and Windows Server 2008 R2 hotfix_is_vulnerable(os:"6.1", file:"Asp.dll", version:"7.5.7600.20741", min_version:"7.5.7600.20000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') || hotfix_is_vulnerable(os:"6.1", file:"Asp.dll", version:"7.5.7600.16620", min_version:"7.5.7600.16000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') || hotfix_is_vulnerable(os:"6.1", file:"Cgi.dll", version:"7.5.7600.20752", min_version:"7.5.7600.20000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2271195') || hotfix_is_vulnerable(os:"6.1", file:"Cgi.dll", version:"7.5.7600.16632", min_version:"7.5.7600.16000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2271195') || # Vista / Windows 2008 hotfix_is_vulnerable(os:"6.0", sp:2, file:"Asp.dll", version:"7.0.6002.22431", min_version:"7.0.6002.22000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') || hotfix_is_vulnerable(os:"6.0", sp:2, file:"Asp.dll", version:"7.0.6002.18276", min_version:"7.0.6002.18000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') || hotfix_is_vulnerable(os:"6.0", sp:1, file:"Asp.dll", version:"7.0.6001.22718", min_version:"7.0.6001.22000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') || hotfix_is_vulnerable(os:"6.0", sp:1, file:"Asp.dll", version:"7.0.6001.18497", min_version:"7.0.6001.18000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') || # Windows 2003 / XP x64 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Asp.dll", version:"6.0.3790.4735", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') || # Windows XP x86 hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Infocomm.dll", version:"6.0.2600.6018", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2290570') || hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Asp51.dll", version:"5.1.2600.6007", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ) { set_kb_item(name:'SMB/Missing/MS10-065', value:TRUE); hotfix_security_warning(); hotfix_check_fversion_end(); exit(0); } else { hotfix_check_fversion_end(); audit(AUDIT_HOST_NOT, 'affected'); }
NASL family Web Servers NASL id IIS_7_PCI.NASL description According to the HTTP server banner the remote server is IIS 7.0. The server may be vulnerable to a number of vulnerabilities including a couple of remote code execution vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 108808 published 2018-04-03 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/108808 title Microsoft IIS 7.0 Vulnerabilities (uncredentialed) (PCI/DSS) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if(description) { script_id(108808); script_version ("1.6"); script_cvs_date("Date: 2018/07/13 15:08:46"); script_cve_id( "CVE-2008-1446", "CVE-2009-3555", "CVE-2010-1256", "CVE-2010-1899", "CVE-2010-2566", "CVE-2010-2730", "CVE-2010-2731" ); script_bugtraq_id( 31682, 36935, 40573, 42246, 41314, 43138, 43140 ); script_xref(name:"MSFT", value:"MS08-062"); script_xref(name:"MSFT", value:"MS10-040"); script_xref(name:"MSFT", value:"MS10-049"); script_xref(name:"MSFT", value:"MS10-065"); script_xref(name:"MSKB", value:"953155"); script_xref(name:"MSKB", value:"2124261"); script_xref(name:"MSKB", value:"2271195"); script_xref(name:"MSKB", value:"2290570"); script_xref(name:"MSKB", value:"982666"); script_xref(name:"MSKB", value:"973917"); script_xref(name:"MSKB", value:"980436"); script_xref(name:"IAVA", value:"2010-A-0120"); script_xref(name:"IAVB", value:"2010-B-0045"); script_xref(name:"IAVB", value:"2008-B-0075"); script_name(english:"Microsoft IIS 7.0 Vulnerabilities (uncredentialed) (PCI/DSS)"); script_summary(english: "Checks the web server banner."); script_set_attribute(attribute:"synopsis", value: "The remote web server may allow remote code execution."); script_set_attribute(attribute:"description", value: "According to the HTTP server banner the remote server is IIS 7.0. The server may be vulnerable to a number of vulnerabilities including a couple of remote code execution vulnerabilities."); script_set_attribute(attribute:"solution", value: "Ensure the appropriate patches have been applied."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(189, 310); script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/03"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:iis"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Web Servers"); script_dependencies("http_version.nasl"); script_require_keys("www/iis", "Settings/ParanoidReport", "Settings/PCI_DSS"); script_require_ports("Services/www", 80); exit(0); } include("audit.inc"); include("global_settings.inc"); include("http.inc"); include("misc_func.inc"); if (!get_kb_item("Settings/PCI_DSS")) { audit(AUDIT_PCI); } if (report_paranoia < 2) { audit(AUDIT_PARANOID); } get_kb_item_or_exit("www/iis"); app = "Microsoft IIS"; port = get_http_port(default:80); banner = get_http_banner(port:port); if (empty_or_null(banner) || "Server: Microsoft-IIS" >!< banner) { audit(AUDIT_NOT_DETECT, app, port); } if ("Server: Microsoft-IIS/7.0" >!< banner) { audit(AUDIT_LISTEN_NOT_VULN, app, port); } security_report_v4(severity:SECURITY_HOLE, port:port); exit(0);
Oval
accepted | 2014-08-18T04:06:23.734-04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
description | Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
id | oval:org.mitre.oval:def:7127 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
submitted | 2010-09-14T13:00:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
title | IIS Repeated Parameter Request Denial of Service Vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
version | 44 |
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 43140 CVE ID: CVE-2010-1899 Microsoft Internet信息服务(IIS)是Microsoft Windows自带的一个网络信息服务器,其中包含HTTP服务功能。 IIS中的脚本处理代码在处理重复的参数请求时存在栈溢出漏洞,远程攻击者可以通过对IIS所承载网站的ASP页面发送特制URI请求来利用这个漏洞,导致服务崩溃。 Microsoft IIS 7.5 Microsoft IIS 7.0 Microsoft IIS 6.0 Microsoft IIS 5.1 临时解决方法: * 在IIS服务器上临时禁用ASP。 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(MS10-065)以及相应补丁: MS10-065:Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960) 链接:http://www.microsoft.com/technet/security/bulletin/MS10-065.mspx?pf=true |
id | SSV:20121 |
last seen | 2017-11-19 |
modified | 2010-09-17 |
published | 2010-09-17 |
reporter | Root |
title | Microsoft IIS重复参数请求拒绝服务漏洞(MS10-065) |