Feeds

Microsoft IIS hole gives System-level access

Redmond "strongly urges" patching "immediately"

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Strong words from the official voice of Redmond today, urging admins to patch a recently-discovered buffer overflow vulnerability in servers running IIS 5.0 on Windows 2000 Server, Windows 2000 Advanced Server and Windows 2000 Datacenter Server, make it clear how serious a security problem the Beast has on its hands.

"Microsoft strongly urges all IIS 5.0 server administrators to install the patch immediately," a company security bulletin says.

The vulnerability was discovered less than a fortnight ago by engineers from eEye Digital Security, while upgrading a network scanner it makes called Retina.

Once upgraded to audit the .printer ISAPI (Internet Server Application Programming Interface) filter (C:\WINNT\System32\msw3prt.dll), which enables Web-based control of networked printers, the Retina implementation reported a buffer overflow which eEye soon found to be exploitable.

Web-based printer support is enabled by default in IIS, unfortunately, so a great many users will be affected.

The vulnerability occurs when a buffer of approximately 420 bytes is sent within the HTTP Host: header for a .printer ISAPI request. Because Win 2K is equipped with a lovely feature which automatically restarts the Web server after a crash, an attacker can gain easy access.

"There are roughly five million Web sites running IIS," eEye Chief Hacking Officer Marc Maiffret told The Register. "If only one million users have upgraded to IIS 5.0 -- a conservative estimate -- then it's obvious how serious this is."

We spoke also with Bill Wall, Chief Computer Security Engineer with the STAT division of Harris Corporation, who confirmed with his own tests that the eEye exploit does in fact work as advertised, quickly and easily giving up system-level control of a Win2K machine.

It's hardly a mystery that a flaw like this exists. The issue, he said, is that the ISAPI filter does inadequate bounds checking on buffers, which leaves the system vulnerable to buffer overflow attacks. "With millions of lines of code to audit, it's no surprise to find calls without adequate limitations," he noted.

"Roughly eighty per cent of vulnerabilities are actually buffer overflows," Wall estimated.

Harris's competing product, STAT Scanner, will be upgraded to include the eEye vulnerability within a few days, he told us.

Marketing windfall

The timing of this discovery couldn't be handier for eEye, as it's got an application firewall called SecureIIS, which works within the IIS process monitoring all incoming requests for signs of attack, which it can then shut down automatically.

As fate would have it, eEye had distributed beta versions of SecureIIS just before it discovered the printer vulnerability. Testers have reported that their systems are not susceptible to it, even though their versions of SecureIIS were developed before it could be taken into account.

Naturally we had to question eEye's Maiffret about the extraordinary convenience, from a marketing perspective, in the timing of today's announcement.

"That's a fair suspicion," he said affably. "But we're confident that it will catch the next one, and the one after that, without any modification or input from users."

We're sure he knows we'll be monitoring this in future, which does lend an air of credibility to the claim. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
Intel's Raspberry Pi rival Galileo can now run Windows
Behold the Internet of Things. Wintel Things
Linux Foundation says many Linux admins and engineers are certifiable
Floats exam program to help IT employers lock up talent
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Eat up Martha! Microsoft slings handwriting recog into OneNote on Android
Freehand input on non-Windows kit for the first time
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.