Microsoft KB Archive/148188

= Internet Information Server Security .CMD /.BAT Patch =

Article ID: 148188

Article Last Modified on 3/15/2000

-

APPLIES TO


 * Microsoft Internet Information Server 1.0

-



This article was previously published under Q148188





SUMMARY
On Sunday, February 25, 1996, Microsoft was alerted to a newsgroup posting regarding a Internet Information Server (IIS) security exposure. This ".CMD /.BAT Bug" allows a complicated string of commands sent from a web browser to an IIS server to be executed on that server.

Malicious internet users can use this capability to tamper with an IIS installation (it is highly unlikely that accidental modification to your IIS installation can happen as a result of this bug).

This problem is not unique to IIS -- similar problems exist with other Windows NT Web servers. As a result, the Microsoft Developer Relations group is in the process of notifying these vendors about the problem and providing guidance so that they can address it where appropriate.



RESOLUTION
Microsoft has developed a fix which provides a permanent solution to this problem. This fix is available now for you to download. It is important to note that you should always follow the safety guidelines outlined in the IIS Installation Guide regarding the securing of IIS against intruders, in order to minimize exposure to security problems. Regardless of whether or not you have followed these instructions, we recommend you download and install the .CMD /.BAT Patch on all IIS installations.

All versions of IIS downloaded from our online distribution sites after March 5, 1996 contains this fix.

This patch is available for each of the Windows NT platforms in the following locations:

Microsoft's WWW server at the following URL:

http://www.microsoft.com/infoserv/iisenhance.htm

Microsoft's FTP server at the following URL:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/IIS/fixes/cmdbat/

To install the patch, download the executable for your platform. The executable automatically installs the fix when executed by an administrator on the IIS system.

To verify the installation of the .CMD /.BAT IIS patch, the system administrator should check the file properties on the file W3SVC.DLL (found in the server sub-directory of your IIS installation tree). The version ID for this file should be 1.0a (Security Update).



WORKAROUND
Microsoft strongly recommends installing this IIS .CMD /.BAT patch, however, if you are unable to download and install this patch in a timely manner, you can implement the following workaround until you are able to install the patch.

This workaround disables the ability to map either MS-DOS Batch files or Windows NT CMD files to the Windows NT Command Interpreter. If you have any CMD or BAT files active as scripts on your IIS installation, this workaround will disable them.

You should take note of the registry keys that are deleted in case you decide to re-enable them at a later date, after the IIS patch has been installed.

WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.

To disable MS-DOS batch and CMD scripts from your server:

 From the Windows NT File Manager File Menu, choose RUN In the RUN dialog box, type REGEDT32, and choose OK From the Window menu in Registry Editor (started in the previous step), select the "HKEY_LOCAL_MACHINE on Local Machine" window The following steps will take you to the Script Mapping key for the Web Server:

 Double click on SYSTEM Double click on CurrentControlSet</li> Double click on Services</li> Double click on W3SVC</li> Double click on Parameters</li> Select the Script Map key</li></ol> </li> Select the entry in the Registry Editor right hand pane that starts with ".BAT"</li> From the Edit menu choose Delete</li> Choose YES to confirm the deletion</li> Select the entry in the Registry Editors right hand pane that starts with ".CMD"</li> From the Edit menu choose Delete</li> Choose YES to confirm the deletion</li> Exit the Registry Editor</li> Stop and Restart the Internet Information Server</li></ol>

<div class="status_section">

STATUS
Microsoft has confirmed this to be a problem in Internet Information Server version 1.0. This problem was corrected in the latest Windows NT 3.51 U.S. Service Pack. For information on obtaining the Service Pack, query on the following word in the Microsoft Knowledge Base (without the spaces):

<pre class="fixed_text">  S E R V P A C K

Additional query words: prodiis

Keywords: kbenv kbnetwork KB148188

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.