Feeds

IIS bug gives attackers complete server control

Linux and Chrome flaws too

Build a business case: developing custom apps

A hacker has uncovered a previously unknown bug in Microsoft's Internet Information Services webserver that in some cases gives attackers complete control of vulnerable machines.

Proof-of-concept code published Monday has been confirmed to give remote root access to servers running version 5 of IIS on Windows 2000 with Service Pack 4. And according to Nikolaos Rangos, the hacker who released the exploit, IIS6 is also vulnerable, even when a memory stack mechanism known as cookie protection is enabled.

The vulnerability appears to be triggered only in limited circumstances, specifically when IIS is set to enable the file transfer protocol and there is a writable folder. While that suggests the majority of IIS installations aren't vulnerable, the universe of affected systems is still big enough to give the security conscious pause.

"I have customers who have Windows 2000 servers and I scold them frequently." said Rodney Thayer, CTO of security research firm Secorix. "I think that's pretty bad, because if Microsoft says it's end of life and they're claiming it's not supported, then you shouldn't be running any software that the vendor says is not supported."

According to Microsoft's website here, mainstream support for IIS5 expired in 2005, but extended support remains in effect until July 2010. Support for Windows 2000 SP4 ends "24 months after the next service pack releases or at the end of the product's support lifecycle, whichever comes first," according to this page.

A Microsoft spokeswoman said company researchers are looking in to the report and will issue a public statement when they're finished. There are no reports of any such vulnerabilities being exploited in the wild, she added.

In May, Rangos disclosed another serious bug in IIS that left the popular web server vulnerable to a simple attack that exposed password-protected files and folders. Microsoft has since fixed it.

The claim of a bug in IIS is just one of three security advisories that greeted IT professionals on Monday morning. A separate vulnerability affecting a wide range of Linux kernels allows unprivileged local users to read parts of kernel memory that may contain sensitive information. While problematic, the bug - unlike like a critical NULL pointer dereference flaw published two weeks ago - doesn't directly lead to privilege escalation.

The hole has been plugged in Linux 2.6.31-rc7, but there appears to be no fix in the more stable 2.6.30.x series yet, Jon Oberheide, the security researcher who published Monday's disclosure, told The Register.

A third vulnerability disclosed Monday affects Google's Chrome browser and could be used in some cases by malicious websites to track web users. More about the bug is available here (PDF). ®

This article was updated to reflect the official dates support expires for IIS and Windows 2000.

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?