New Security Problems with IIS

Internet Security Systems Security Alert April 10, 2002

Multiple Remote Vulnerabilities in Microsoft IIS

Synopsis:

ISS X-Force has learned that Microsoft Internet Information Server (IIS) is affected by ten new remote vulnerabilities. These vulnerabilities vary in severity from mild to critical. A remote attacker may exploit one or more of these vulnerabilities to cause a target Web server to crash, execute arbitrary commands on the server, or gain complete control of a target IIS server.

1. Heap Buffer overflow in ASP chunked encoding routines (CAN-2002-0079)

…

Other security problems with IIS that have been recently discovered:

Flattery gets you root access.

It can be bribed with hockey tickets.

Say “I’m going to tell on you!” and it will run away and leave all its passwords on the ground.

Categories: Uncategorized dw