GRNET-CERT
Suggested Guidelines Against Sadmind/IIS Worm  

• Unpatched versions of Microsoft IIS
• Unpatched versions of Solaris up to, and including, Solaris 7

The worm uses two well-known vulnerabilities to compromise systems and deface web pages.

http://www.kb.cert.org/vuls/id/28934

http://www.cert.org/advisories/CA-1999-16.html

After successfully compromising the Solaris systems, it uses a vulnerability to compromise the IIS systems. For additional information about this vulnerability, see

http://www.kb.cert.org/vuls/id/111677

Solaris systems compromised by this worm are being used to scan and compromise other Solaris and IIS systems. IIS systems compromised by this worm can suffer modified web content.

Suggested Solutions

A patch is available from Microsoft at

http://www.microsoft.com/technet/security/bulletin/MS00-078.asp

For IIS Version 4:
http://www.microsoft.com/ntserver/nts/downloads/critical/q269862/default.asp

For IIS Version 5:
http://www.microsoft.com/windows2000/downloads/critical/q269862/default.asp

Additional advice on securing IIS web servers is available from

http://www.microsoft.com/technet/security/iis5chk.asp
http://www.microsoft.com/technet/security/tools.asp

Apply a patch from Sun Microsystems as described in Sun Security Bulletin #00191:

http://sunsolve.sun.com/pub-cgi/retrieve.pl? doctype=coll&doc=secbull/191&type=0&nav=sec.sba

 References

1. Vulnerability Note VU#111677: Microsoft IIS 4.0 / 5.0 vulnerable to directory traversal via extended unicode in url (MS00-078) http://www.kb.cert.org/vuls/id/111677
2. CERT Advisory CA-1999-16 Buffer Overflow in Sun Solstice AdminSuite Daemon sadmind http://www.cert.org/advisories/CA-1999-16.html

Authors:  Chad Dougherty, Shawn Hernan, Jeff Havrilla, Jeff Carpenter, Art Manion, Ian Finlay, John Shaffer