Security

Ask something
Discussion Locked

Web Site security problem

0 helpful
5 replies

by locuslink

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hacking into Web Site: Another one:
One of my web sites runs on IIS 4 with NT 4 and NT service pack 6a. The site consists of asp pages with an asa page which sets sessions to the SQL 7 server for database queries. SQL 7 is running on another box and not on the Web server. I am currently experiencing a situation where several persons are using the following command to expose the username and password that is used by the asa page to create a session to the SQL server:

http://www."Websitename"/null.htw?CiWebHitsFile=/"Foldername"/"Subfoldername"/
search.asp%20&CiRestriction=none&CiHiliteType=Full

Which security patch for IIS should be applied here?

Appreciate any help here. Thank you

5 replies

by msullivan

The hacker is taking advantage of your content index service. You have indexed your .ASA file giving the hacker an easy way to expose information. The url is simply querying the content index.

Your solution is to tell the index service to exclude the ASA file.

Hope this helps
Mike

by alex

Yes Mike is right they are exploiting your index server. This is possible on any machine with Index Server installed, even those with no normal .htw files, because the virtual file null.htw is stored in memory and the .htw extension is mapped by default to webhits.dll.
If WebHits functionality is not required, the .htw extension can be unmapped from webhits.dll in the Internet Service Manager.

Here is the re-released patch from Microsoft

Microsoft patch Q252463i
http://download.microsoft.com/download/winntsp/Patch/MHH/NT4/EN-US/Q252463i.EXE

Good luck,
Alex Skinner

This discussion is closed to new replies.