Feeds

Microsoft IIS security hole persists despite available patch

You can lead a horse to water...

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

An old and subsequently well-publicised flaw in Microsoft Internet Information Server (IIS), which allows anyone with a Web browser to gain admin-level access to a server, continues to plague many sites in spite of the availability patches to correct it.

The flaw first became news just over a year ago with a flurry of advisories posted on numerous news sites, and Microsoft did respond and issue a patch. Wired, for example, ran their coverage on 15 June of last year.

However, as one of The Register's sharp-eyed readers has discovered and brought to our attention, putting the word out and issuing a patch hardly guarantees that anyone will bother to install it.

The hole enables an unauthorised visitor to determine what version of NT is running, and to see or easily guess file and directory locations with a mind towards further exploitation of the site. On an e-commerce site with a shopping cart application running, the flaw can make it easy to compromise consumers' account details.

Among the more high-profile sites reported to be running the product in a still-unpatched version are Safeway, IKEA and Tower Records. Undoubtedly many thousands of less-known sites are as well. The Register has confirmed the hole in the instances mentioned above, but for obvious reasons we're not describing the exploit in detail. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
'Internet Freedom Panel' to keep web overlord ICANN out of Russian hands – new proposal
Come back with our internet! cries Republican drawing up bill
What a Mesa: Apple vows to re-use titsup GT sapphire glass plant
Commits to American manufacturing ... of secret tech
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?