IIS Advisory

[Marc () EEYE COM (Marc)]

Hi,

I have been getting a few eMails from people saying they could not reproduce
the overflow. Most of them were using NT4's ftp.exe. If you look at what
NT4's ftp.exe does... it does not send the ls command correctly therefore
its not going to work. If you would like to test the overflow I suggest two
things. Use NT5's ftp.exe or write your own code. We didnt want to release a
hack.exe program to test the overflow. To many people would run around
crashing whatever they could find.

So please stop sending me eMail saying you cannot do it. If you are sending
it correctly and cannot reproduce it then send me an eMail. However please
dont send me something like the following:

> I could not reproduce this on a machine with Wintdows NT 4.0/Service Pack 4
> and IIS 4.0.
> I get "sorry, input line too long".

Thats your clients problem.

Once again if your either writing your own program or using an ftp program
that functions properly and the overflow still does not work. Then eMail me.

Signed,
Marc
eEye Digital Security Team
http://www.eEye.com