Check Point Advisories

Microsoft IIS ISAPI Extension Indexing Service Buffer Overflow (MS01-033; CVE-2001-0500)

Check Point Reference: CPAI-2009-287
Date Published: 13 Dec 2009
Severity: Critical
Last Updated: Sunday 23 January, 2022
Source:
Industry Reference:CVE-2001-0500
Protection Provided by:

Security Gateway
R81, R80, R77, R75, R71, R70
Who is Vulnerable?
Vulnerability Description The Internet Information Server (IIS) is a collection of Internet services packaged with several versions of the Windows operating system. IIS includes a Web server component that is capable of serving static, as well as dynamic content. There exists a vulnerability in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier which allows remote attackers to execute arbitrary commands via a specially-crafted Indexing Service request to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by CodeRed. In the event of a successful attack, a buffer overflow condition can allow an attacker to gain control over the affected server. This vulnerability is exploitable using the "CodeRed" and "CodeRed II" worms. The "CodeRed" worm is a self-propagating worm that can perform malicious activity on vulnerable servers, as well as propagate into additional servers. The "CodeRed II" worm contains a trojan horse payload which further compromises the affected servers.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75 / R71 / R70

  1. In the IPS tab, click Protections and find the Microsoft IIS ISAPI Extension Indexing Service Buffer Overflow (MS01-033) protection using the Search tool and Edit the protection's settings.
  2. Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name:  Web Server Enforcement Violation.
Attack Information:  Microsoft IIS ISAPI Extension Indexing Service Buffer Overflow (MS01-033)

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK