Rapid7 Vulnerability & Exploit Database

NT IIS idq.dll Directory Traversal Vulnerability

Back to Search

NT IIS idq.dll Directory Traversal Vulnerability

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Published
01/26/2000
Created
07/25/2018
Added
11/01/2004
Modified
07/31/2012

Description

A vulnerability in idq.dll can allow an attacker to gain read access to any file on the same logical drive as the web server virtual root. The attacker has to know the physical path and filename of the requested file, and the ACL for the file must specify read access for either the anonymous user or the Everyone or Guest group.

idq.dll will follow the '../' string in the specification of a template file. Any file can be specified as the template file. Although some IDQ files append the '.htx' extension to the user's input, it is possible to circumvent this by appending several spaces to the end of the requested filename, eg: 'desiredfile.txt%20%20%20...%20%20.htx'. What this will do is provide the '.htx' so the system thinks it is a valid template file, but when it retrieves the file the '.htx' string is pushed out of the buffer, the spaces are ignored, and the desired file is returned.

The webhits.dll patch (Microsoft Security Bulletin MS00-006, at http://www.securityfocus.com/templates/advisory.html?id=2060, and Bugtraq ID 950, at http://www.securityfocus.com/bid/950 may in some cases affect the nature of this vulnerability. If this patch has been applied, IDQ files will only be vulnerable if they do not append the .htx extension.

Solution(s)

  • http-iis-0029

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;