Re: Executing a locally installed program in IIS 6

From: Tim (anonymous_at_discussions.microsoft.com)
Date: 07/27/04

  • Next message: anonymous_at_discussions.microsoft.com: "Re: IIS 6.0 on Windows Server 2003" 
    Date: Tue, 27 Jul 2004 08:09:04 -0700

    Thanks for the follow up.

    I agree that this is a security hole and am looking into
    other alernitives.

    Thanks

    >-----Original Message-----
    >Hi, I've been on the other thread. This is the problem
    with multi-posting,
    >Tim. Multiple people on a given problem and not aware of
    each other.
    >
    >At this point, it appears that PHP requires enabling a
    security
    >vulnerability on Windows Server 2003 in order to function
    (its shell()
    >function needs CMD.EXE to have weak ACLs and accessible
    via IIS -- something
    >we explicitly denied with IIS6 on Windows Server 2003).
    I gave some
    >possible alternatives, but the underlying problem is PHP
    needing a security
    >vulnerability to "work" without modifications.
    >
    >--
    >//David
    >IIS
    >This posting is provided "AS IS" with no warranties, and
    confers no rights.
    >//
    >"tim" <tim@discussions.microsoft.com> wrote in message
    >news:2ec001c470e4$9fb218c0$a601280a@phx.gbl...
    >ok well I guess I was not specific enough in this post. I
    >have found another thread that I thought was talking about
    >the similar problem and posted in there thinking that they
    >were having the same problem. (turns out it was something
    >different) "Re: IIS 6.0 on Windows Server 2003."
    >
    >Howerver Here is the excerpt of the message
    >My case is
    >-----------
    >Allow the user to browse to a web page, which executes
    >zipcode.exe on the server, and the web page formats the
    >output and returns it to the browser as a web page.
    >---------
    >
    >When a visitor browses
    >http://mysite.com/lookup.php?zipcode=03791
    >The lookup.php page takes the input var of 03791 and
    >passes
    >it off to the zipcode.exe (a commandline module for
    >windows)
    >
    >then the results are sent back to the php page to be used
    >to look up information.
    >
    >So basically zipcode.exe a command line tool that returns
    >a
    >result based on the var's passed.
    >
    >This tool works in my existing IIS 5 web site application
    >in my windows 2000 server.
    >
    >We are upgrading a new server that is running windows 2003
    >server with IIS 6.
    >
    >I have IIS and PHP 4 running and ALL of my php pages are
    >running fine except the ones that call zipcode.exe
    >
    >I have read the if I give execute permissions to
    >%SystemRoot%/System32/cmd.exe for the user IUSR_sytemname
    >then the shell command will work.
    >I'm reluctant to give access rights to the IUSR_sytemname
    >because of security reasons.
    >
    >Is their any workaround other than giving access rights to
    >the command line?
    >
    >Thanks
    >Tim
    >
    >
    >.
    >

  • Next message: anonymous_at_discussions.microsoft.com: "Re: IIS 6.0 on Windows Server 2003"

    Relevant Pages

    • Re: IIS 6.0 on Windows Server 2003
      ... If PHP insists on using CMD.EXE to execute the shellcommand on the ... server, then no, you have no choice -- you must give read permissions to the ... this would be a security vulnerability caused by PHP. ...
      (microsoft.public.inetserver.misc)
    • Re: Looking for general advice on security
      ... with the words "and be security conscious by using SSL" on the last page which is what most adviice I've found so far boils down to. ... I've located standard advice such as using PHP strip-tags on input fields and other PHP specific stuff but was wondering how best to get interactive with the security. ... Set safe mode on if it's not already the default mode on your server. ... Of course only applicable if you have access to your own server as root. ...
      (comp.lang.php)
    • Re: Problem with psftp in .NET.
      ... Now, if your goal is copy files from server to client's FTP site, then why ... security perspective, this is very ill-advised. ... As i told before that command is running fine through command prompt ... administrator user. ...
      (microsoft.public.dotnet.general)
    • [UNIX] Serious Flaw in Unreal IRCd (Server Linking, Svsnick)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Let us take a quick look at how the Unreal IRCd linking protocol works: ... SERVER 1 ... the bug is in the JOIN command. ...
      (Securiteam)
    • Re: [PHP] Out source files
      ... >> server, and use URL fopen to read them, if you like. ... In several PHP security recommendation we can read "Do not let PHP ... a vulnerability of the application doesn't expose all the data to the ...
      (php.general)