URL: http://www.olympos.org/article/articleprint/736/-1/7/microsoft_site_server_3_0_icerik_gonderme_dos_acigi
|
Microsoft Site Server 3.0 İçerik Gönderme DoS Açığı
|
|
Ana sayfa
Haberler
Güvenlik Açıkları
Microsoft
Geçerli NT kullanıcı hesapları, 'cphost.dll' modülünü kullanarak Site Server 3.0
için içerik gönderebilirler. Bu işlem sırasında, C:\Temp dizininde (bu dizin
değiştirilemez) geçici dosyalar oluşturulur.
Eğer, kötü niyetli bir kullanıcı, TargetURL parametresi ya da yaklaşık 250 karakterden uzun bir içerik gönderecek olursa, gönderme işlemi sonuçsuz kalacak ve yaratılmış olan geçici dosya da
silinmeyecektir. Yetkili bir saldırgan, bu açığı kullanarak C: sürücüsündeki tüm boş alanı doldurup, bir Denial of Service (servislerin görev dışı kalması) durumuna yol açabilir.
Çözüm:
Henüz bir yama çıkmadı.
ref: http://www.securityfocus.com/bid/4002
Etkilenen Sistemler
Etkilenenler:
Microsoft Site Server 3.0SP4 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0SP4 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0SP3 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0SP3 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0SP2 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0SP2 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0SP1 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0SP1 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server 3.0 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP4 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP4 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP3 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP3 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP2 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP2 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP1 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0SP1 alpha
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0 i386
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Microsoft Site Server Commerce Edition 3.0 alpha
- Microsoft BackOffice 4.5
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
Etkilenmeyenler: