Security Risks of Default IIS 5.0 on Windows 2000

When Microsoft released Windows 2000, Internet Information Services (IIS) 5.0 was installed and enabled by default on server editions, adhering to an "accessible by default" philosophy rather than a security-first approach. This configuration exposed unpatched systems to immediate remote compromise due to unnecessary features, default sample applications, unmanaged script mappings, and weak permissions. The resulting vulnerabilities led to widespread exploitation, most notably by devastating global worm outbreaks such as Code Red and Nimda.

Unrestricted ISAPI Extensions and Buffer Overflows

Default IIS 5.0 deployments mapped numerous file extensions to specific Internet Server Application Programming Interface (ISAPI) dynamic link libraries (DLLs), regardless of whether the administrator intended to use those features. Many of these handlers contained critical buffer overflow vulnerabilities:

  • Indexing Service (.ida, .idq): Mapped to idq.dll, this handler contained an unchecked buffer in its URL decoding routine. Attackers used this flaw to execute arbitrary code remotely, providing the entry vector for the infamous Code Red worm in 2001.
  • Internet Printing Protocol (.printer): Mapped to msw3pr.dll, this extension allowed web-based printing management. A buffer overflow in the parsing of the Host: header allowed unauthenticated remote attackers to gain administrative control.
  • Legacy Scripting (.htr, .idc, .shtm): These legacy handlers suffered from multiple vulnerabilities, including buffer overflows and source code disclosure flaws that allowed attackers to view the contents of password-protected or server-side script files.

Directory Traversal and Unicode Exploits

Default IIS 5.0 installations suffered from critical flaws in how URL paths and extended character sets were canonicalized and validated:

  • Unicode Directory Traversal: Attackers bypassed path-checking routines by using overlong UTF-8 representations of characters (such as %c0%af for a slash /). This allowed unauthorized traversal outside the web root directory.
  • Double Decode Vulnerability: IIS parsed URLs twice in certain execution paths. Attackers could encode a backslash or slash twice (e.g., %255c), slipping past security checks on the first pass while resolving to a valid path delimiter on the second.

Combined, these flaws allowed attackers to access executables like cmd.exe in the system directory, enabling arbitrary remote command execution without authentication.

Vulnerable Default Scripts and Sample Content

Default installations placed various sample files, virtual directories, and administrative utilities onto the web server:

  • Sample Applications (/iissamples, /iishelp): These sample folders contained debugging utilities and scripts with inherent security flaws, such as input-validation bypasses and sensitive information disclosure.
  • Remote Data Service (RDS) Exploits: Default virtual directories such as /msadc hosted msadcs.dll. Flaws in RDS allowed remote attackers to execute native SQL queries or shell commands with administrative privileges.

Excessive System Privileges

IIS 5.0 ran web applications in-process using the LocalSystem account by default, or out-of-process using the privileged IWAM_computername account. Because the core web server executed under LocalSystem:

  • Any successful buffer overflow or code execution exploit instantly inherited full system-level access to the underlying operating system.
  • Attackers did not need to perform secondary privilege escalation steps; compromise of the web service equaled total compromise of the host.

Enabled WebDAV Functionality

Web Distributed Authoring and Versioning (WebDAV) was enabled out of the box in IIS 5.0 via httpext.dll. It permitted HTTP methods such as PROPFIND, SEARCH, and PUT. Unpatched WebDAV implementations exposed servers to denial-of-service conditions, buffer overflows, and unauthorized file uploads or modifications.