IIS malformed .HTR request
advICE :Intrusions : 2002559

Summary

An attempt has been made to compromise the server via the .HTR buffer overflow.

Details

This bug was first discovered in June 1999. It has since become one of the most popular ways of breaking into Windows NT web-servers. The reason it is so popular is because the default installation of IIS4 creates this vulnerability, and most people do not "harden" their servers.

Defense

Read the Microsoft bulletin below in order to disable the mapping for the .HTR, .STM, and .IDC extensions. Another possibility is to remove the ISM.DLL ISAPI extension. If these services are needed, then the latest patches should be applied to fix the bug.

parametric information URL The suspicious URL. accessed Indicates whether the URL was successfully accessed. code The HTTP return code. arg The argument to the GET command (if any).

 
Version appeared: 1.8.5.5