Web Server Holes Exposed in Mirosoft IIS

psimon.2009 · 09-08-2009, 07:54 AM

Patch is still work in progress

Microsoft is investigating reports of a couple of new vulnerabilities found in the FTP service of the IIS web server, which could potentially grant remote code execution to an untrusted user.

Seemingly the flaws were revealed directly to the public last week, rather than the finder bringing them to the attention of Microsoft first.

In an official notice the company said it was aware of limited attacks that used the exploit code.

It said that any one running the IIS FTP server on Windows 2003 or earlier, or running FTP 6.0 on Vista or Windows 2008, should consult the latest security advisory posted to the Microsoft site.

The vulnerability is a stack overflow in the FTP service when listing a long, specially-crafted directory name.

The vulnerable code is only to be found in IIS 5.0 (Windows 2000), IIS 5.1 (Windows XP) and IIS 6.0 (Windows Server 2003).

Microsoft has said a patch was already in development, but it is highly unlikely to be ready in time for this month's Patch Tuesday.

09-08-2009, 07:54 AM	#1 (permalink)
psimon.2009 Registered User Join Date: Sep 2009 Location: London Posts: 5 OS: Win XP	Web Server Holes Exposed in Mirosoft IIS Patch is still work in progress Microsoft is investigating reports of a couple of new vulnerabilities found in the FTP service of the IIS web server, which could potentially grant remote code execution to an untrusted user. Seemingly the flaws were revealed directly to the public last week, rather than the finder bringing them to the attention of Microsoft first. In an official notice the company said it was aware of limited attacks that used the exploit code. It said that any one running the IIS FTP server on Windows 2003 or earlier, or running FTP 6.0 on Vista or Windows 2008, should consult the latest security advisory posted to the Microsoft site. The vulnerability is a stack overflow in the FTP service when listing a long, specially-crafted directory name. The vulnerable code is only to be found in IIS 5.0 (Windows 2000), IIS 5.1 (Windows XP) and IIS 6.0 (Windows Server 2003). Microsoft has said a patch was already in development, but it is highly unlikely to be ready in time for this month's Patch Tuesday. __________________ Computer Business Review - A Technology News Resource Last edited by koala; 09-08-2009 at 09:29 AM. Reason: link