Feeds

Microsoft IIS hole gives System-level access

Redmond "strongly urges" patching "immediately"

  • alert
  • submit to reddit

3 Big data security analytics techniques

Strong words from the official voice of Redmond today, urging admins to patch a recently-discovered buffer overflow vulnerability in servers running IIS 5.0 on Windows 2000 Server, Windows 2000 Advanced Server and Windows 2000 Datacenter Server, make it clear how serious a security problem the Beast has on its hands.

"Microsoft strongly urges all IIS 5.0 server administrators to install the patch immediately," a company security bulletin says.

The vulnerability was discovered less than a fortnight ago by engineers from eEye Digital Security, while upgrading a network scanner it makes called Retina.

Once upgraded to audit the .printer ISAPI (Internet Server Application Programming Interface) filter (C:\WINNT\System32\msw3prt.dll), which enables Web-based control of networked printers, the Retina implementation reported a buffer overflow which eEye soon found to be exploitable.

Web-based printer support is enabled by default in IIS, unfortunately, so a great many users will be affected.

The vulnerability occurs when a buffer of approximately 420 bytes is sent within the HTTP Host: header for a .printer ISAPI request. Because Win 2K is equipped with a lovely feature which automatically restarts the Web server after a crash, an attacker can gain easy access.

"There are roughly five million Web sites running IIS," eEye Chief Hacking Officer Marc Maiffret told The Register. "If only one million users have upgraded to IIS 5.0 -- a conservative estimate -- then it's obvious how serious this is."

We spoke also with Bill Wall, Chief Computer Security Engineer with the STAT division of Harris Corporation, who confirmed with his own tests that the eEye exploit does in fact work as advertised, quickly and easily giving up system-level control of a Win2K machine.

It's hardly a mystery that a flaw like this exists. The issue, he said, is that the ISAPI filter does inadequate bounds checking on buffers, which leaves the system vulnerable to buffer overflow attacks. "With millions of lines of code to audit, it's no surprise to find calls without adequate limitations," he noted.

"Roughly eighty per cent of vulnerabilities are actually buffer overflows," Wall estimated.

Harris's competing product, STAT Scanner, will be upgraded to include the eEye vulnerability within a few days, he told us.

Marketing windfall

The timing of this discovery couldn't be handier for eEye, as it's got an application firewall called SecureIIS, which works within the IIS process monitoring all incoming requests for signs of attack, which it can then shut down automatically.

As fate would have it, eEye had distributed beta versions of SecureIIS just before it discovered the printer vulnerability. Testers have reported that their systems are not susceptible to it, even though their versions of SecureIIS were developed before it could be taken into account.

Naturally we had to question eEye's Maiffret about the extraordinary convenience, from a marketing perspective, in the timing of today's announcement.

"That's a fair suspicion," he said affably. "But we're confident that it will catch the next one, and the one after that, without any modification or input from users."

We're sure he knows we'll be monitoring this in future, which does lend an air of credibility to the claim. ®

SANS - Survey on application security programs

More from The Register

next story
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Windows XP still has 27 per cent market share on its deathbed
Windows 7 making some gains on XP Death Day
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.