2129.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid: 2129


--
Summary:
This event is generated when an attempt is made to access nsiislog.dll on a host running Microsoft Internet Information Server (IIS). 

--
Impact:
Possible buffer overrun leading to arbitrary code execution.

--
Detailed Information:
This event indicates that an attempt has been made to access nsiislog.dll on a host running Microsoft Internet Information Server (IIS).

The attacker may be trying to overflow a buffer using nsiislog.dll. This can present the attacker with the opportunity to execute arbitrary code of his choice on the vulnerable system. The vulnerability occurs when requests for Server Side Includes are not properly checked by the web server.

--
Affected Systems:
Any host using IIS 5.0.

--
Attack Scenarios:
An attacker can overflow a buffer and then proceed to execute arbitrary code.

--
Ease of Attack:
Simple.

--
False Positives:
None Known.

--
False Negatives:
None Known.

--
Corrective Action:
Upgrade to the latest non-affected version of the software.

Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.

Ensure that the IIS implementation is fully patched.

Ensure that the underlying operating system is fully patched.

Employ strategies to harden the IIS implementation and operating system.

Check the host for signs of compromise.

--
Contributors:
Sourcefire Vulnerability Research Team
Brian Caswell <[e-mail]>
Nigel Houghton <[e-mail]>

--
Additional References:

Microsoft Technet:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-018.asp

--