Information Security News mailing list archives
IIS 6 attack could let hackers snoop on servers
From: InfoSec News <alerts () infosecnews org>
Date: Tue, 19 May 2009 02:28:18 -0500 (CDT)
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9133219 By Robert McMillan May 18, 2009 IDG News Service Security vendors are warning users of Microsoft's Internet Information Services 6 Web-server software that a new online attack could put their data at risk. The flaw was made public Thursday, when security researcher Nikolaos Rangos posted details of the vulnerability to the Full Disclosure security mailing list. By sending a specially crafted HTTP request to the server he was able to view and upload files on the machine. The attack takes advantage of a bug in the way that Microsoft's software processes Unicode tokens, he said. The vulnerability is being used in online attacks, the U.S. Computer Emergency Response Team said Monday. In a statement, Microsoft said it hadn't heard of any such attacks, but that it was investigating Rangos' claims. "We are working on a security advisory to provide customers with guidance," the company said Monday. The bug affects IIS 6 users who have enabled the WebDAV (Web-based Distributed Authoring and Versioning) protocols, used to share documents via the Web. [...] -- LayerOne 2009, Information Security for the discerning professional. May 23-24 2009 @ The Anaheim Marriott in Anaheim, California Visit http://layerone.info for more information
Current thread:
- IIS 6 attack could let hackers snoop on servers InfoSec News (May 19)