Why are you re-releasing this update?
Subsequent to the release of this update Microsoft was made aware that under certain circumstances the original update provided with this bulletin did not replace the vulnerable file on the hard drive. These situations involved whether or not Windows Media Services was uninstalled previous to the application of the update. Microsoft has addressed this issue and is re-releasing the update on Windows Update and the Microsoft Download Center.
Should I re-apply the update?
If the vulnerable version of NSIISLOG.DLL is still on the system, you will be offered the update again if you go to Windows Update. You can search your system for the NSIISLOG.DLL file to determine if the update should be applied. To do this, perform the following steps: If you have installed Windows Media Services on Windows 2000 Server, then the nsiislog.dll file is automatically copied to the proper IIS directory and loaded. To determine if nsiislog.dll is installed on the computer, perform the following steps:
1. | From the Start Menu, click search. |
2. | Click For Files or Folders |
3. | In the search dialog, type in the file name, NSIISLOG.DLL |
4. | Click Search Now. |
5. | If the file is not present, you do not need to apply this update. If the file is present, right click the file and choose properties. |
6. | Click the Version tab |
7. | If the file version is less than 4.1.0.3932, you should apply this re-released update. |
What's the scope of the vulnerability?
This is a Buffer Overrun vulnerability. An attacker who successfully exploited this vulnerability could cause a Windows 2000 server that was performing streaming media logging to fail in a way that could allow code to execute in the security context of the IIS service.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by constructing a specific network request and sending it to the server running Windows Media Services. The attacker would have to know which server on the network or Internet had Windows Media Services installed in order to cause the server to stop responding to IIS requests or cause code to execute in the server.
What could this vulnerability enable an attacker to do?
This vulnerability could enable an attacker to execute code of his or her choice on a computer running IIS with Windows Media Services installed. The code would execute in the context of the account under which IIS was running, which could allow the attacker to take any action on the system.
What causes the vulnerability?
The vulnerability results because of an unchecked buffer used by nsiislog.dll, the streaming media component that is used to log multicast requests. If a specially crafted request was sent to the server, the logging program would attempt to write a larger buffer than was available, which then in turn could cause the IIS service to fail and could allow code of the attacker's choice to execute.
What is nsiislog.dll?
Nsiislog.dll is an IIS ISAPI extension that is included with Windows 2000 Server. It provides logging capabilities for Media Streaming in Microsoft Windows Media Services. It is installed and used automatically whenever Windows Media Services are installed on a computer.
What versions of IIS might be affected by the vulnerable version of nsiislog.dll?
The vulnerable version of nsiislog.dll can be installed on IIS 5.0.
What products does IIS 5.0 ship with?
Internet Information Service 5.0 is included with Windows 2000 Datacenter Server, Advanced Server, Server and Professional.
Does IIS 5.0 run by default?
IIS 5.0 runs by default on all Windows 2000 server products. It does not run by default on Windows 2000 Professional.
What are Microsoft Windows Media Services?
Windows Media Services is a feature of Windows 2000 Server, Advanced Server, and Datacenter Server and provides streaming audio and video services for use over corporate intranets and the Internet.
Can I install Windows Media Services on Windows 2000 Professional?
No - Windows Media Services are only available for Microsoft Windows Server operating systems, such as Windows 2000 Server, Advanced Server and Datacenter Server.
Does this vulnerability affect Windows Media Services on Windows NT 4.0?
That depends. If you have applied the previous patch for Windows Media Servers from security bulletin MS03-019, this vulnerability does not affect Windows NT 4.0.
What is Multicast Media Streaming?
Multicast media streaming is a method of delivering media content to clients across a network. In contrast to unicast media streaming, multicasting sends a single copy of the data that can be received by any clients that request it. Multiple copies of data are not sent across the network, nor is data processed by clients who do not request it. For more information on Multicast Media Streaming, please see the following web site:
http://www.microsoft.com/windows/windowsmedia/forpros/server/server.aspx
How can I determine whether someone has set up my computer to perform multicast streaming media logging?
If you have installed Windows Media Services on Windows 2000 Server, then the nsiislog.dll file is automatically copied to the proper IIS directory and loaded. To determine if nsiislog.dll is installed on the computer, perform the following steps:
| • | From the Start Menu, click search. |
| • | Click For Files or Folders |
| • | In the search dialog, type in the file name, NSIISLOG.DLL |
| • | Click Search Now. |
If the file NSIISLOG.DLL is present in any directory shared by IIS, then the server is configured for logging clients of multicast streams.
What does the Patch do?
The fix eliminates the vulnerability by ensuring that the Nsiislog.dll file correctly responds to requests.
