Microsoft ASP.NET vulnerability (updated Oct. 7th) Microsoft announced a possible vulnerability in ASP.NET ( http://www.microsoft.com/security/incident/aspnet.mspx ). There are not much details so far, but it refers to the "canonicalization" functionality and suggest to implement then hardening measures outlined in KB887459 ( http://support.microsoft.com/?kbid=887459 ). It appears that a particularly crafted request may confuse ASP.Net and allow access to otherwise protected directories. If a web server receives a request for a particular URL (e.g. _http://server/somedirectory/filename), the 'somedirectory/filename' part has to be mapped to a particular file located on the server. This translation has been the source of many "directory traversal" bugs. The IIS unicode exploit is probably the most famous one. After our original posting of this diary, a few users pointed to the following articles which provide more details then provided by Microsoft's advisory:
(Thanks to Chaouki & Daniel)
http://www.heise.de/security/news/meldung/51730 (german)
http://www.derkeiler.com/Mailing-Lists/NT-Bugtraq/2004-09/0068.html
http://blogs.devleap.com/rob/archive/2004/10/02/1803.aspx (italian)
http://www.k-otik.com/news/10052004.ASPNETFlaw.php (french)
It appears that by switching a '/' character in the URL with '\' or '%5C', the canonicalization routine will be confused. So if the URL:
http://www.example.com/secure/file.apx
is password protected, using the either of the following URLs will bypass the restriction:
http://www.example.com/secure\file.apx
http://www.example.com/secure%5Cfile.apx
In addition to the slash/back-slash confusion, one reader reports that inserting a space will bypass the URL restriction as well:
http://www.example.com/%20/secure/file.apx
(had no chance to validate this method so far)
URL Obfuscation Handler and star SANS instructor Ed Skoudis compiled a comprehensive list of various URL obfuscation methods used in phishing schemes and spam. Some of these methods do not work with all browsers (e.g. the %01 issue in older Internet Explorer versions). In order to preserve the tricky details of some of these methods, we setup a page which includes just the URL methods without our usual header and footer: http://isc.sans.org/presentations/urlobfuscation.php (to view as source: http://isc.sans.org/presentations/urlobfuscation.txt ). Jan Reilink wrote to point us to this page with more details about URL obfuscation and decoding: http://www.pc-help.org/obscure.htm . DDOS in progress A reader noted that a system on his Universities campus participated in a DDOS attack against 69.93.181.74. If you see any machines with excessive traffic to this IP address, please investigate further. We still need a copy of the respective malware to identify the controller. More MD5 sum tools Raul pointed out a nice MD5 sum tool, 'md5deep'. It will traverse directories and supports various hash formats. For details, see http://md5deep.sourceforge.net/ . Another reader suggested digestIT: http://digestit.kennethballard.com/features.html . It integrates with Microsoft Explorer which makes it particularly easy to use. _____________
Johannes Ullrich. jullrich |a_|sans.org