Feeds

IIS bug gives attackers complete server control

Linux and Chrome flaws too

Protecting against web application threats using SSL

A hacker has uncovered a previously unknown bug in Microsoft's Internet Information Services webserver that in some cases gives attackers complete control of vulnerable machines.

Proof-of-concept code published Monday has been confirmed to give remote root access to servers running version 5 of IIS on Windows 2000 with Service Pack 4. And according to Nikolaos Rangos, the hacker who released the exploit, IIS6 is also vulnerable, even when a memory stack mechanism known as cookie protection is enabled.

The vulnerability appears to be triggered only in limited circumstances, specifically when IIS is set to enable the file transfer protocol and there is a writable folder. While that suggests the majority of IIS installations aren't vulnerable, the universe of affected systems is still big enough to give the security conscious pause.

"I have customers who have Windows 2000 servers and I scold them frequently." said Rodney Thayer, CTO of security research firm Secorix. "I think that's pretty bad, because if Microsoft says it's end of life and they're claiming it's not supported, then you shouldn't be running any software that the vendor says is not supported."

According to Microsoft's website here, mainstream support for IIS5 expired in 2005, but extended support remains in effect until July 2010. Support for Windows 2000 SP4 ends "24 months after the next service pack releases or at the end of the product's support lifecycle, whichever comes first," according to this page.

A Microsoft spokeswoman said company researchers are looking in to the report and will issue a public statement when they're finished. There are no reports of any such vulnerabilities being exploited in the wild, she added.

In May, Rangos disclosed another serious bug in IIS that left the popular web server vulnerable to a simple attack that exposed password-protected files and folders. Microsoft has since fixed it.

The claim of a bug in IIS is just one of three security advisories that greeted IT professionals on Monday morning. A separate vulnerability affecting a wide range of Linux kernels allows unprivileged local users to read parts of kernel memory that may contain sensitive information. While problematic, the bug - unlike like a critical NULL pointer dereference flaw published two weeks ago - doesn't directly lead to privilege escalation.

The hole has been plugged in Linux 2.6.31-rc7, but there appears to be no fix in the more stable 2.6.30.x series yet, Jon Oberheide, the security researcher who published Monday's disclosure, told The Register.

A third vulnerability disclosed Monday affects Google's Chrome browser and could be used in some cases by malicious websites to track web users. More about the bug is available here (PDF). ®

This article was updated to reflect the official dates support expires for IIS and Windows 2000.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.