## Microsoft WindowsNT IIS Vulnerability

### Risk Factor: 8

### Machines Affected:

WindowsNT machines running MicroSoft's IIS versions prior to 1.0c

### Description:

The IIS Web Publishing Service is not chrooted.

### Consequences:

Any file on a intel WindowsNT box running IIS can be downloaded, as long as the files you want to download are on the same partition as the IIS root directory.

Ex.

You enter the URL and a directory below the IIS root directory. Any directory will do, as long as it is a subdirectory to the IIS root. Most of the IIS installations have the directory scripts or images so it isnīt to hard to find a suitable directory. Then you just ".." your way up in the directory structure.

Example

http://www.victim.com/images/../../../mssql/customer.database

### Fix:

A patch is available for this at www.microsoft.com/infoserv/iisservpack.htm
Or you can upgrade your version to 1.0c or get version 2.0 that ships with WindowsNT 4.0

Additonal Information on the IIS Web Server bugs is available at http://www.omna.com/msiis .