Feeds

Microsoft IIS hole gives System-level access

Redmond "strongly urges" patching "immediately"

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Strong words from the official voice of Redmond today, urging admins to patch a recently-discovered buffer overflow vulnerability in servers running IIS 5.0 on Windows 2000 Server, Windows 2000 Advanced Server and Windows 2000 Datacenter Server, make it clear how serious a security problem the Beast has on its hands.

"Microsoft strongly urges all IIS 5.0 server administrators to install the patch immediately," a company security bulletin says.

The vulnerability was discovered less than a fortnight ago by engineers from eEye Digital Security, while upgrading a network scanner it makes called Retina.

Once upgraded to audit the .printer ISAPI (Internet Server Application Programming Interface) filter (C:\WINNT\System32\msw3prt.dll), which enables Web-based control of networked printers, the Retina implementation reported a buffer overflow which eEye soon found to be exploitable.

Web-based printer support is enabled by default in IIS, unfortunately, so a great many users will be affected.

The vulnerability occurs when a buffer of approximately 420 bytes is sent within the HTTP Host: header for a .printer ISAPI request. Because Win 2K is equipped with a lovely feature which automatically restarts the Web server after a crash, an attacker can gain easy access.

"There are roughly five million Web sites running IIS," eEye Chief Hacking Officer Marc Maiffret told The Register. "If only one million users have upgraded to IIS 5.0 -- a conservative estimate -- then it's obvious how serious this is."

We spoke also with Bill Wall, Chief Computer Security Engineer with the STAT division of Harris Corporation, who confirmed with his own tests that the eEye exploit does in fact work as advertised, quickly and easily giving up system-level control of a Win2K machine.

It's hardly a mystery that a flaw like this exists. The issue, he said, is that the ISAPI filter does inadequate bounds checking on buffers, which leaves the system vulnerable to buffer overflow attacks. "With millions of lines of code to audit, it's no surprise to find calls without adequate limitations," he noted.

"Roughly eighty per cent of vulnerabilities are actually buffer overflows," Wall estimated.

Harris's competing product, STAT Scanner, will be upgraded to include the eEye vulnerability within a few days, he told us.

Marketing windfall

The timing of this discovery couldn't be handier for eEye, as it's got an application firewall called SecureIIS, which works within the IIS process monitoring all incoming requests for signs of attack, which it can then shut down automatically.

As fate would have it, eEye had distributed beta versions of SecureIIS just before it discovered the printer vulnerability. Testers have reported that their systems are not susceptible to it, even though their versions of SecureIIS were developed before it could be taken into account.

Naturally we had to question eEye's Maiffret about the extraordinary convenience, from a marketing perspective, in the timing of today's announcement.

"That's a fair suspicion," he said affably. "But we're confident that it will catch the next one, and the one after that, without any modification or input from users."

We're sure he knows we'll be monitoring this in future, which does lend an air of credibility to the claim. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Whistling Google: PLEASE! Brussels can only hurt Europe, not us
And Commish is VERY pro-Google. Why should we worry?
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
First in line to order a Nexus 6? AT&T has a BRICK for you
Black Screen of Death plagues early Google-mobe batch
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.