Feeds

Major MS Web Server security hole exposed, plugged

Bug-fix terrorism? Whatever next?

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

Security outfit eEye has roused Microsoft's ire and garnered itself some cheap publicity by going public with information on what it says is a serious security flaw in Microsoft's Internet Information Server (IIS) 4.0. The move hasn't helped the company's relationship with Microsoft any, but it seems to have triggered the appearance of a swift patch, full fix to follow. According to eEye the flaw allows arbitrary code to be run on any web server running IIS 4.0, and by using a buffer overflow bug in the software attackers can remotely execute code to enable access to all data on the server." So it's a serious one, although Microsoft says it hasn't had any reports of the security hole being used so far. eEye accuses Microsoft of failing to give the problem the attention it deserved. The company claims to have hassled MS for days, but "after the fifth day of reporting the bug to Microsoft, they stopped responding to our emails." So the company went public with the problem three days later, as an attempt to force Microsoft's hand. Microsoft swiftly posted a patch, but accuses eEye of irresponsibility in publicising a problem before a fix had been found. There's some justification in that, but there's also some in the view that being able to announce "we've found a hole, but we fixed it" is better than having to confirm "Yike, there's a huge security hole in our product." ®

Boost IT visibility and business value

More from The Register

next story
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Sonos AXES support for Apple's iOS4 and 5
Want to use your iThing? You can't - it's too old
Amazon says Hachette should lower ebook prices, pay authors more
Oh yeah ... and a 30% cut for Amazon to seal the deal
Philip K Dick 'Nazi alternate reality' story to be made into TV series
Amazon Studios, Ridley Scott firm to produce The Man in the High Castle
Joe Average isn't worth $10 a year to Mark Zuckerberg
The Social Network deflates the PC resurgence with mobile-only usage prediction
Chips are down at Broadcom: Thousands of workers laid off
Cellphone baseband device biz shuttered
Feel free to BONK on the TUBE, says Transport for London
Plus: Almost NOBODY uses pay-by-bonk on buses - Visa
Twitch rich as Google flicks $1bn hitch switch, claims snitch
Gameplay streaming biz and search king refuse to deny fresh gobble rumors
Stick a 4K in them: Super high-res TVs are DONE
4,000 pixels is niche now... Don't say we didn't warn you
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.