Four New Flaws Found in IIS

Microsoft on Wednesday issued a cumulative patch for Internet Information Services that fixed four newly discovered flaws in the Web server.

The flaws affect IIS 4.0, which runs on Windows NT 4.0; IIS 5.0, which runs on Windows 2000; and IIS 5.1, which runs on Windows XP. IIS 6.0, which shipped with Windows Server 2003 last month and received a security overhaul under the Trustworthy Computing initiative, is not affected.

The most serious problem affects IIS 5.0 and 5.1 and is rated "important" by Microsoft.

"A denial of service vulnerability that results because IIS 5.0 and 5.1 do not correctly handle an error condition when an overly long WebDAV request is passed to them. As a result an attacker could cause IIS to fail – however both IIS 5.0 and 5.1 will by default restart immediately after this failure," Microsoft wrote in its bulletin about the most serious flaw.

The other three flaws are rated "moderate." Microsoft's threat scale ranges from "low" to "moderate" to "important" to "critical."

A cross-site scripting vulnerability affects IIS 4.0, 5.0 and 5.1. A buffer overrun involves IIS 5.0. A separate denial-of-service vulnerability affects IIS 4.0 and IIS 5.0.

The IIS security bulletin can be found at:

The new patch is dependent on a patch issued in a security bulletin last year (MS02-050). If the new patch is installed and MS02-050 is not in place, client-side certificates will be rejected.

The bulletin is one of two issued by Microsoft on Wednesday. The other bulletin deals with a moderate denial-of-service threat to Windows NT 4.0 and Windows 2000.

That bulletin is available here:

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Microsoft Offers More Help on Windows Server 2008 Upgrades

    Microsoft this week published additional help resources for organizations stuck on Windows Server 2008, which fell out of support on Jan. 14.

  • Microsoft Ups Its Carbon Reduction Goals

    Microsoft on Thursday announced a corporatewide carbon reduction effort that aims to make the company "carbon negative" by 2030.

  • How To Dynamically Lock Down an Unattended Windows 10 PC

    One of the biggest security risks in any organization happens when a user walks away from their PC without logging out. Microsoft has the solution (and it's not a password-protected screensaver).

  • First Stable Chromium-Based Microsoft Edge Browser Released

    Microsoft on Wednesday announced the first release of its Chromium-based Microsoft Edge browser at the "stable" commercial-release stage.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.