Microsoft IIS UTF 执行远程攻击者任意代码漏洞

/ns/ld/win/data/20010926102206.htm

发现 Microsoft IIS 存在 UTF 目录遍历漏洞，攻击者利用此漏洞能在受影响机器上执行任意代码。

正常情况下，IIS 会阻断 HTTP 请求中那些对 WEB 根目录之外文件的访问。但是，通过使用特殊的 UTF 编码，攻击者能绕过这种过滤机制而非法访问系统文件，并在受影响服务器上执行任意代码。利用此漏洞，远程攻击者通过 WEB 客户端能以 IUSR_machinename 帐号身份访问系统文件：

http://target/Scripts/..%u0025u005c..u0025u005cWINNT/system32/cmd.exe?/c+dir+c:

受影响系统：
Microsoft IIS 4.0
- Cisco Building Broadband Service Manager 5.0
- Cisco Call Manger 1.0
- Cisco Call Manger 2.0
- Cisco Call Manger 3.0
- Cisco ICS 7750
- Cisco IP/VC 3540
- Cisco Unity Server 2.0
- Cisco Unity Server 2.2
- Cisco Unity Server 2.3
- Cisco Unity Server 2.4
- Cisco uOne 1.0
- Cisco uOne 2.0
- Cisco uOne 3.0
- Cisco uOne 4.0
- Microsoft BackOffice 4.0
- Microsoft BackOffice 4.5
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0SP1
- Microsoft Windows NT 4.0SP2
- Microsoft Windows NT 4.0SP3
- Microsoft Windows NT 4.0SP4
- Microsoft Windows NT 4.0SP5
- Microsoft Windows NT 4.0SP6
- Microsoft Windows NT 4.0SP6a
- Microsoft Windows NT 4.0SP7
- Microsoft Windows NT 4.0 Option Pack
Microsoft IIS 5.0
- Microsoft Windows 2000
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 SP1
- Microsoft Windows 2000 SP2
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Datacenter Server SP1
- Microsoft Windows 2000 Datacenter Server SP2
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server SP2

解决方案：
微软尚未做出反应，建议用户对某些系统命令和脚本作访问权限控制。