S-183: Vulnerability in Internet Information Services


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) S-183: Vulnerability in Internet Information Services
# 1  
Old 02-21-2008
S-183: Vulnerability in Internet Information Services

A remote code execution vulnerability exists in the way that Internet Information Services handles input to ASP Web pages. The risk is LOW. An attacker could exploit the vulnerability by passing malicious input to a Web site's ASP page. An attacker who successfully exploited this vulnerability could then perform any actions on the IIS Server with the same rights as the Worker Process Identity (WPI), which by default is configured with Network Service account privileges.


More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
slp(7P) 							     Protocols								   slp(7P)

NAME
slp - Service Location Protocol DESCRIPTION
The Service Location Protocol (SLP) is a dynamic service discovery protocol that runs on top of the Internet Protocol (IP). The protocol is specified by the IETF standard-track documents RFC 2165, RFC 2608, RFC 2609; the API is documented in RFC 2614. . There are two components to the SLP technology. The first is a daemon, slpd(1M), which coordinates SLP operations. The second is a software library, slp_api(3slp), through which processes access a public API. Both components are configured by means of the SLP configuration file, slp.conf(4). The SLP API is useful for two types of processes: Client Applications Services and service information can be requested from the API. Clients do not need to know the location of a required service, only the type of service, and optionally, the service characteristics. SLP will supply the loca- tion and other information to the client through the API. Server Processes Programs that offer network services use the SLP API to advertise their location as well as other service informa- tion. The advertisement can optionally include attributes describing the service. Advertisements are accompanied by a lifetime; when the lifetime expires, the advertisement is flushed, unless it is refreshed prior to expiration. API libraries are available for both the C and Java languages. SLP provides the following additional features: o slpd(1M) can be configured to function as a transparent directory agent. This feature makes SLP scalable to the enterprise. System administrators can configure directory agents to achieve a number of different strategies for scalability. o SLP service advertising and discovery is performed in scopes. Unless otherwise configured, all discovery and all advertisements are in the scope default. In the case of a larger network, scopes can be used to group services and client systems so that users will only find those services which are physically near them, belong to their department, or satisfy the specified criteria. Administrators can configure these scopes to achieve different service provider strategies. o Services may be registered by proxy through a serialized registration file. This is an alternative to registering services through the API. See slpd.reg(4) for more information. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWslpu | +-----------------------------+-----------------------------+ |CSI |CSI-enabled | +-----------------------------+-----------------------------+ |Interface Stability |Standard | +-----------------------------+-----------------------------+ |MT-Level |MT-Safe | +-----------------------------+-----------------------------+ SEE ALSO
slpd(1m), slp_api(3slp), slp.conf(4), slpd.reg(4), attributes(5) Guttman, E., Perkins, C., Veizades, J., and Day, M., RFC 2608, Service Location Protocol, Version 2, The Internet Society, June 1999. Guttman, E., Perkins, C., and Kempf, J., RFC 2609, Service Templates and Service: Schemes, The Internet Society, June 1999. Kempf, J. and Guttman, E., RFC 2614, An API for Service Location, The Internet Society, June 1999. Veizades, J., Guttman, E., Perkins, C., and Kaplan, S., RFC 2165, Service Location Protocol, Network Working Group, 1997. SunOS 5.10 17 Nov 1999 slp(7P)