Signature Detail

HTTP: IIS .Htr Overflow Attempt

This signature detects attempts to exploit a known vulnerability against Microsoft IIS 4.0 and 5.0. Attackers can send maliciously crafted HTR requests (.htr) with long variable names to overflow the buffer in the ism.dll ISAPI extension that implements HTR scripting. A successful attack can create a denial of service or allows the attacker to execute arbitrary commands.

Extended Description

A buffer overflow in the HTR ISAPI extension has been reported for Microsoft IIS (Internet Information Services). This condition affects IIS 4.0, IIS 5.0 and may be effectively mitigated by disabling the extension. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host. A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves.

Affected Products

• Cisco Building Broadband Service Manager (BBSM) 4.0.1
• Cisco Building Broadband Service Manager (BBSM) 4.2.0
• Cisco Building Broadband Service Manager (BBSM) 4.3.0
• Cisco Building Broadband Service Manager (BBSM) 4.4.0
• Cisco Building Broadband Service Manager (BBSM) 4.5.0
• Cisco Building Broadband Service Manager (BBSM) 5.0.0
• Cisco Building Broadband Service Manager (BBSM) 5.1.0
• Cisco Call Manager 3.0.0
• Cisco Call Manager 3.1.0
• Cisco Call Manager 3.2.0
• Cisco Unity Server 2.0.0
• Cisco Unity Server 2.1.0
• Cisco Unity Server 2.2.0
• Cisco Unity Server 2.3.0
• Cisco Unity Server 2.4.0
• Microsoft IIS 4.0
• Microsoft IIS 5.0
• Microsoft IIS 5.1

References

• BugTraq: 4474
• CERT: CA-2002-09
• CVE: CVE-2002-0071