Microsoft IIS 4 "webhits.dll" Vulnerability (MS00-006)

Microsoft IIS (Internet Information Server) Version 4.0 ships with an ISAPI application called webhits.dll, which provides hit-highlighting functionality for Index Server. webhits.dll dispatches files with an .htw extension.

webhits.dll contains a vulnerability that allows malicious users to break out of the Web virtual root filesystem and gain unathorized access to other files on the same logical disk drive.

If successfully exploited, unauthorized users can access any file on your server, including .asp files.

For more information about this vulnerability and for links to available patches, read Microsoft's Security Bulletin MS00-006.

Alternatively, you can perform the following workaround:

1. Open the Internet Server Manager (MMC).
2. In panel on the left, right click the computer you wish to administer. Then, choose Properties from the resulting pop-up menu.
3. From the Master Properties window, highlight the WWW Service, and then click Edit.
4. The WWW Service Master properties window should open. From here, click on the Home Directory tab, and then click the Configuration button. The App Mappings tab in the Application Mappings window should appear.
5. Find the .htw extension, highlight it, and then click Remove.
6. If a confirmation window appears, select Yes to remove the extension.
7. Click Apply, and then select all of the child nodes this should apply to.
8. Click OK, and then close all of the WWW Service Property windows.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

MS00-006: Index Server 2.0 (Intel )

MS00-006: Index Server 2.0 (Alpha )

MS00-006: Indexing Service in Windows 2000 (Intel )