[SECURITY-L] CAIS-Alerta: Vulnerabilidade no Internet Information Services (MS08-006)

[CSIRT - UNICAMP]

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Vulnerabilidade no Internet Information Services
 (MS08-006)
To: pop-seg em cais.rnp.br, rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Tue, 12 Feb 2008 18:01:14 -0200 (BRST)

-----BEGIN PGP SIGNED MESSAGE-----


Prezados,

O CAIS esta' repassando o alerta da Microsoft, intitulado "MS08-006 - 
Vulnerability in Internet Information Services Could Allow Remote Code 
Execution (942830)", que trata de uma vulnerabilidade recem-descoberta no 
Internet Information Services (IIS).

A vulnerabilidade existe devido `a maneira incorreta como o IIS manipula a 
entrada de dados em paginas desenvolvidas utilizando-se a linguagem ASP. 
Caso um atacante consiga explorar com sucesso esta vulnerabilidade, ele 
podera executar remotamente codigo malicioso no servidor IIS com as mesmas 
permissoes do "Worker Process Identity (WPI)", que por padrao e' 
configurado com os privilegios da conta "Network Service".


Sistemas afetados:

. Windows XP Professional Service Pack 2 (IIS 5.1)
. Windows XP Professional x64 Edition (IIS 6.0)
. Windows XP Professional x64 Edition Service Pack 2 (IIS 6.0)
. Windows Server 2003 Service Pack 1 (IIS 6.0)
. Windows Server 2003 Service Pack 2 (IIS 6.0)
. Windows Server 2003 x64 Edition (IIS 6.0)
. Windows Server 2003 x64 Edition Service Pack 2 (IIS 6.0)
. Windows Server 2003 com SP1 para sistemas baseados em Itanium (IIS 6.0)
. Windows Server 2003 com SP2 para sistemas baseados em Itanium (IIS 6.0)


Correcoes disponiveis:

Recomenda-se fazer a atualizacao para as versoes disponiveis em :

. Windows XP Professional Service Pack 2 (IIS 5.1)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=2b498065-d682-4227-b23e-d234d7d6a3fe

. Windows XP Professional x64 Edition (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=df9875f7-04d6-486e-bdb5-35e9e305fa1d

. Windows XP Professional x64 Edition Service Pack 2 (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=df9875f7-04d6-486e-bdb5-35e9e305fa1d

. Windows Server 2003 Service Pack 1 (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6583e798-d16d-419c-aee1-30c3e6c635b3

. Windows Server 2003 Service Pack 2 (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6583e798-d16d-419c-aee1-30c3e6c635b3

. Windows Server 2003 x64 Edition (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?familyid=e8286174-8209-409f-8805-e534715a741c

. Windows Server 2003 x64 Edition Service Pack 2 (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?familyid=e8286174-8209-409f-8805-e534715a741c

. Windows Server 2003 com SP1 para sistemas baseados em Itanium (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?familyid=29faa70d-f1ac-4da4-b72a-faf1973cd845

. Windows Server 2003 com SP2 para sistemas baseados em Itanium (IIS 6.0)
  http://www.microsoft.com/downloads/details.aspx?familyid=29faa70d-f1ac-4da4-b72a-faf1973cd845


Mais informacoes:

. MS08-006 - Vulnerability in Internet Information Services Could Allow Remote Code Execution (942830)
  http://www.microsoft.com/technet/security/bulletin/ms08-006.mspx

. SANS ISC Handler's Diary 2008-02-12: February Black Tuesday overview
  http://isc.incidents.org/diary.html?storyid=3973

. Microsoft Brasil Security
  http://www.microsoft.com/brasil/security

. Technet Brasil - Central de Seguranca
  http://www.technetbrasil.com.br/seguranca

. Windows Live OneCare
  http://safety.live.com/site/pt-BR/default.htm


Identificador CVE (http://cve.mitre.org): CVE-2008-0075


O CAIS recomenda que os administradores mantenham seus sistemas e 
aplicativos sempre atualizados, de acordo com as ultimas versoes e 
correcoes oferecidas pelos fabricantes.


Os Alertas do CAIS tambem sao oferecidos no formato RSS/RDF:
http://www.rnp.br/cais/alertas/rss.xml


Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Made with pgp4pine 1.76

iQCVAwUBR7H7Dukli63F4U8VAQHCTAP/XUv7ARoAPtfrjtbXx7eZUebaFBoylDOc
HoRY0n7EDH/XFjQYPPN0Fj6PTLiIRKXbFzQzJjp7iJLdKTnwLlfgvjKKMwC4Ar8W
GuDjBibGwLJecEKNfTxxV4P3dEtfbL5MKPQYAIRJ+aAyTmzcMX3unQFjFyDFE2zf
49e2/+ezWQQ=
=6Zny
-----END PGP SIGNATURE-----


----- End forwarded message -----