{"vuid":"VU#203126","idnumber":"203126","name":"Microsoft IIS contains vulnerability in NNTP service","keywords":["Microsoft","remote code execution","NNTP","MS04-036","883935"],"overview":"A vulnerability in the NNTP component of Microsoft IIS may allow a remote attacker to compromise the affected system.","clean_desc":"The Network News Transport Protocol (NNTP) is a protocol for the distribution, inquiry, retrieval, and posting of news articles over a network. Microsoft's Internet Information Services (IIS) provides support for a number of protocols, including NNTP. In addition to the original protocol specification in IETF RFC977, a number of standard extensions to NNTP are specified in RFC2980. One of these, the XPAT command, is used to retrieve specific headers from specific articles, based on pattern matching on the contents of the header. Several related flaws exist in the way the NNTP component handles the parsing and translation of user-supplied search patterns. These flaws result in a vulnerability that could be exploited by an attacker with the ability to send a specially crafted message to the affected server.","impact":"A remote unauthenticated attacker may be able to execute code of their choosing with administrative privileges on the affected system.","resolution":"Apply a patch from the vendor Microsoft has published Microsoft Security Bulletin MS04-036 in response to this issue. Users are strongly encouraged to review this bulletin and apply the patches it refers to.","workarounds":"Workarounds In addition to the patches referenced above, Microsoft has published workarounds for this issue. Users who are unable to apply the patches are strongly encouraged to implement these workarounds as appropriate.","sysaffected":"","thanks":"Thanks to Lucas Lavarello and Juliano Rizzo of \nCore Security Technologies\n for reporting this issue.","author":"This document was written by Chad R Dougherty based on information provided by Microsoft and Core Security Technologies.","public":["http://www.microsoft.com/technet/security/bulletin/MS04-036.mspx","http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10"],"cveids":["CVE-2004-0574"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2004-10-12T20:13:05Z","publicdate":"2004-10-12T00:00:00Z","datefirstpublished":"2004-10-21T21:14:09Z","dateupdated":"2004-10-22T13:47:11Z","revision":15,"vrda_d1_directreport":"0","vrda_d1_population":"2","vrda_d1_impact":"2","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"15","cam_impact":"19","cam_easeofexploitation":"15","cam_attackeraccessrequired":"15","cam_scorecurrent":"30.05859375","cam_scorecurrentwidelyknown":"36.0703125","cam_scorecurrentwidelyknownexploited":"60.1171875","ipprotocol":"","cvss_accessvector":"--","cvss_accesscomplexity":"--","cvss_authentication":null,"cvss_confidentialityimpact":"--","cvss_integrityimpact":"--","cvss_availabilityimpact":"--","cvss_exploitablity":null,"cvss_remediationlevel":"ND","cvss_reportconfidence":"ND","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"0","cvss_basevector":"AV:--/AC:--/Au:--/C:--/I:--/A:--","cvss_temporalscore":"0","cvss_environmentalscore":"0","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":30.05859375,"vulnote":null}