|
 |
|
Shop
You are here: News > News > Microsoft Confirms Server Vulnerability Reports
| » IT Security NEWS |
| » 19 May 2009 |
| Microsoft Confirms Server Vulnerability Reports |
| Last week, a report revealed that there's a bug in Microsoft's Internet Information Server (IIS). This week, Microsoft confirms that report, stating that versions 5.0, 5.1, and 6.0 are all susceptible to this vulnerability, although the error is absent in IIS 7.0. Attackers are able to bypass the access-protected folders and files (as well as the authentication functions) by using an anonymous default server account and exploiting an error in the WebDAV function while decoding URLs containing Unicode characters. However, contrary to the original report, Microsoft clarifies that default user accounts are denied write access on the server automatically. Therefore, the vulnerability doesn't permit files to be stored on the server. On the other hand, the WebDAV vulnerability in IIS 6.0 allows hackers to download and even upload arbitrary files via access through password-protected directories. The report states that access isn't constrained to WebDAV folders. The all-encompassing vulnerability affects each and every last directory managed by the web server. A flaw in the processing of Unicode characters makes this possible. The discoverer of the hole, Nicolaos Rangos, informs that a request with a header induces the IIS to send back a protected file from a regular folder sans authentication. WebDAV isn't activated by default. Those who have enabled it should disable it or deny remote accesses from the Internet until further notice. A similar susceptibility in IIS was discovered way back in 2000 in IIS versions 4 and 5. Thierry Zoller, a security expert, outright compared this old vulnerability to this new one in a blog post of his. According to Microsoft, WebDAV is normally enabled after installing IIS, and it's only switched off in the event that IIS 6.0 is installed on Windows Server 2003. The software giant afterwards released more information about vulnerable IIS configurations in its blog, "Security Research and Defense". However, Microsoft neglects to mention in its security advisory whether the problem will be solved with an update. Only after finishing its examination of the situation will further steps towards a resolution be taken. "Depending on customer needs", they may create a patch or include the fix on a major update. Until that time, Microsoft recommends users to either deny access to anonymous users or disable WebDAV altogether. Instructions on how to do either things are given in the security advisory. |
 |
 |
Awards & Reviews | |||||
|
||||||
|
|
Subscribe to our Mailing List |
|
|
|
|
Customer References | |
|
||
