Goatse Security Emergency Update! Microsoft IIS Directory Traversal Vulnerability! Do you know where your children are?

[DiKKy Heartiez <dikkyheartiez () hotmail com>]

Goatse Security researchers have discovered a new vulnerability spreading in Microsoft's IIS products.
SynopsisBy using specially crafted URLs (uniform resource locators), an attacker can run commands and arbitrary code on 
a remote machine.
ExploitBy using the unicode equivalent of the "/" character (%c0%af) in a URL (or double-encoding part of the "../" 
string), directory traversal outside the document root is possible, and arbitrary commands can be passed to the cmd.exe 
interpreter for execution.  For example:
http://xx.xx.xx.xx/scripts/..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+echo+OWNED+BY+LULZSEC!+>+c:\inetpub\wwwroot\default.asp
Affected productsMicrosoft IIS versions 4.0-5.0 
StatusThis exploit is being used by expert hacking groups such as Anonymous, LulzSec, and the Phone Losers of America, 
as well as Turkish and Iranian individuals.  There are also scattered reports of a worm dubbed Code Red that makes use 
of this exploit.
VendorMicrosoft has been contacted repeatedly by Goatse Security but has failed to respond.
SolutionGoatse Security recommends the use of Symantec's Norton 360, the all-in-one security service that protects you, 
your PC, and your data from today's internet threats.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/