Feeds

Microsoft IIS hole gives System-level access

Redmond "strongly urges" patching "immediately"

  • alert
  • submit to reddit

High performance access to file storage

Strong words from the official voice of Redmond today, urging admins to patch a recently-discovered buffer overflow vulnerability in servers running IIS 5.0 on Windows 2000 Server, Windows 2000 Advanced Server and Windows 2000 Datacenter Server, make it clear how serious a security problem the Beast has on its hands.

"Microsoft strongly urges all IIS 5.0 server administrators to install the patch immediately," a company security bulletin says.

The vulnerability was discovered less than a fortnight ago by engineers from eEye Digital Security, while upgrading a network scanner it makes called Retina.

Once upgraded to audit the .printer ISAPI (Internet Server Application Programming Interface) filter (C:\WINNT\System32\msw3prt.dll), which enables Web-based control of networked printers, the Retina implementation reported a buffer overflow which eEye soon found to be exploitable.

Web-based printer support is enabled by default in IIS, unfortunately, so a great many users will be affected.

The vulnerability occurs when a buffer of approximately 420 bytes is sent within the HTTP Host: header for a .printer ISAPI request. Because Win 2K is equipped with a lovely feature which automatically restarts the Web server after a crash, an attacker can gain easy access.

"There are roughly five million Web sites running IIS," eEye Chief Hacking Officer Marc Maiffret told The Register. "If only one million users have upgraded to IIS 5.0 -- a conservative estimate -- then it's obvious how serious this is."

We spoke also with Bill Wall, Chief Computer Security Engineer with the STAT division of Harris Corporation, who confirmed with his own tests that the eEye exploit does in fact work as advertised, quickly and easily giving up system-level control of a Win2K machine.

It's hardly a mystery that a flaw like this exists. The issue, he said, is that the ISAPI filter does inadequate bounds checking on buffers, which leaves the system vulnerable to buffer overflow attacks. "With millions of lines of code to audit, it's no surprise to find calls without adequate limitations," he noted.

"Roughly eighty per cent of vulnerabilities are actually buffer overflows," Wall estimated.

Harris's competing product, STAT Scanner, will be upgraded to include the eEye vulnerability within a few days, he told us.

Marketing windfall

The timing of this discovery couldn't be handier for eEye, as it's got an application firewall called SecureIIS, which works within the IIS process monitoring all incoming requests for signs of attack, which it can then shut down automatically.

As fate would have it, eEye had distributed beta versions of SecureIIS just before it discovered the printer vulnerability. Testers have reported that their systems are not susceptible to it, even though their versions of SecureIIS were developed before it could be taken into account.

Naturally we had to question eEye's Maiffret about the extraordinary convenience, from a marketing perspective, in the timing of today's announcement.

"That's a fair suspicion," he said affably. "But we're confident that it will catch the next one, and the one after that, without any modification or input from users."

We're sure he knows we'll be monitoring this in future, which does lend an air of credibility to the claim. ®

High performance access to file storage

More from The Register

next story
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
Microsoft: Windows version you probably haven't upgraded to yet is ALREADY OBSOLETE
Pre-Update versions of Windows 8.1 will no longer support patches
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Windows XP still has 27 per cent market share on its deathbed
Windows 7 making some gains on XP Death Day
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
US taxman blows Win XP deadline, must now spend millions on custom support
Gov't IT likened to 'a Model T with a lot of things on top of it'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.