CORRECTION: Remote IIS 5.x and IIS 6.0 Server Name Spoof

I just wanted to clarify some issues here. First of all, this is by no means a 
new discovery. Others have mentioned it and I even used it as an example in my 
book "Hacking the Code". It is not a flaw in the handling of the server 
variable, but a bug in the 500-100.asp script. It is also important to note 
that this issue does not affect IIS 6 as Inge claims. 

The original code in IIS 5 used the SERVER_NAME variable to see if the user was 
local with this code:

                If (strServername = "localhost" or strServerIP = strRemoteIP)  
And .....

In IIS 6 they updated the code to this:

                If (strServerIP = strRemoteIP) And...

A quick fix for this is to pull the 500-100.asp script from IIS 6 and use it 
for IIS 5. A better fix is to simply replace that error with a static html page.

So if you maintain a vulnerability database, write vulnerability scanners, 
assign vulnerability ID numbers, or if you somehow document this, you should 
correct this so we all don't have to explain this every time in the next 10 
years that someone runs vulnerability scanner on IIS 6 and this shows up in the 
report.

Incidently, you do not need to use telnet to manually enter the URL to exploit 
this. An easier solution is to change your HOSTS file so that localhost points 
to the remote IP address of the target IIS server. Then you can use your 
browser to hammer away at it.


Mark Burnett