Microsoft confirms IIS zero-day flaw; Exploit code published

TalkBack 1 of 15:

Next »

• Thread View
• Flat View

Can I summarize?

First you need to not only install IIS, you
also need to install the FTP functionality in
IIS. Got it.

Also, remember that only servers that allow
untrusted users to log on and create arbitrary
directories are vulnerable.

Then you have to configure your FTP server to
allow anyone to login without entering a
password and then give them write permission.

IIS 6 is at reduced risk because it was
built with /GS which help protect the service
from exploits by deliberately terminating
itself when the overflow is detected before
attacker?s code runs. We have not seen exploit
code for this vulnerability that is able to
bypass the /GS protection.

Got it. So while there is a buffer overflow
flaw in IIS 6, if you ever try to take
advantage of it, FTP restarts itself before
your attack code has a chance to run. And IIS5
was replaced 6 years ago.

While we have seen detailed exploit code
published on the Internet for this
vulnerability, we are not currently aware of
active attacks that use this exploit code

No kidding. And if you do get hit by this, run,
don't walk, to your HR department and have them
fire your entire IT staff.

Posted by: NonZealot   Posted on: 09/01/09 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now