[Xitami] is Xitami hack-proof?

[Andrew Morris]

I read an article recently about how hackers can get into IIS systems using
Unicode sequences (such as the %255c shown below), which IIS does not
process correctly and causes it to allow access to areas of the hard disk
which should be under security. Looks like a hacker is trying to view your
root directory contents by executing the DIR command using cmd.exe...

 - Excerpt from article -
Top Vulnerabilities to Windows Systems (W)
W1 - Unicode Vulnerability (Web Server Folder Traversal)
W1.1 Description:
Unicode provides a unique number for every character, no matter what the
platform, no matter what the program, no matter what the language. The
Unicode Standard has been adopted by most vendors, including Microsoft. By
sending an IIS server a carefully constructed URL containing an invalid
Unicode UTF-8 sequence an attacker can force the server to literally ‘walk
up and out’ of a directory and execute arbitrary scripts. This type of
attack is also known as the directory traversal attack.

The Unicode equivalents of / and \ which are %2f and %5c, respectively.
However, you can also represent these characters using so-called "overlong"
sequences. Overlong sequences are technically invalid Unicode
representations that are longer than what is actually required to represent
the character. Both / and \ can be represented with a single byte. An
overlong representation, such as %c0%af for / represents the character using
two bytes. IIS was not written to perform a security check on overlong
sequences. Thus, passing an overlong Unicode sequence in a URL, will bypass
Microsoft’s security checks. If the request is made from a directory marked
as "executable" the attacker can cause the executable files to be executed
on the server. Additional information on the Unicode threat can be found at:

http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2


The full URL of the article is at http://66.129.1.101/top20.htm

Hope this helps...I'm not expert but your e-mail reminded me of the article.
Looks like its only an IIS threat anyway.
Andy



-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of Mike Shumko
Sent: 22 October 2001 15:41
To: 'xitami@lists.xitami.org'
Subject: [Xitami] is Xitami hack-proof?


I've been running Xitami on my NT Workstation for years. Works great, love
it.

I notice in my access logs that I have tons of requests every day for items
such as

"GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0"

"GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

My guess is that these are attempts to hack into a MS IIS web server. Are
any of these attempts ever successful against a Xitami web server?

I ask this because I had a process running on my NT Workstation this morning
called Proxy Desktop, which I don't recognize. So I'm wondering if my
workstation was compromised thru the web server.

Mike Shumko
Senior Manager
Robelle Solutions Technology Inc.
1.888.robelle
www.robelle.com



--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami