There's a Hole in IIS -- Redmondmag.com

Barney's Blog

There's a Hole in IIS

Internet Information Services (IIS) has a big hole, and so far there's no fix -- just a warning. Versions 5 through 6 are vulnerable to an "elevation of privilege" attack.

So far no one has been struck, as far as we know, and there are some things you can do. Make sure your access control lists are disciplined and that those who don't need access don't have it. You can also set up fake admin accounts that don't actually have admin rights. This way an intruder may think he's cracked your system, but can't actually do anything. Pretty clever.

Posted by Doug Barney on 05/20/2009 at 1:16 PM

Featured

Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.
What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.