Four New Flaws Found in IIS

Microsoft on Wednesday issued a cumulative patch for Internet Information Services that fixed four newly discovered flaws in the Web server.

The flaws affect IIS 4.0, which runs on Windows NT 4.0; IIS 5.0, which runs on Windows 2000; and IIS 5.1, which runs on Windows XP. IIS 6.0, which shipped with Windows Server 2003 last month and received a security overhaul under the Trustworthy Computing initiative, is not affected.

The most serious problem affects IIS 5.0 and 5.1 and is rated "important" by Microsoft.

"A denial of service vulnerability that results because IIS 5.0 and 5.1 do not correctly handle an error condition when an overly long WebDAV request is passed to them. As a result an attacker could cause IIS to fail – however both IIS 5.0 and 5.1 will by default restart immediately after this failure," Microsoft wrote in its bulletin about the most serious flaw.

The other three flaws are rated "moderate." Microsoft's threat scale ranges from "low" to "moderate" to "important" to "critical."

A cross-site scripting vulnerability affects IIS 4.0, 5.0 and 5.1. A buffer overrun involves IIS 5.0. A separate denial-of-service vulnerability affects IIS 4.0 and IIS 5.0.

The IIS security bulletin can be found at:

The new patch is dependent on a patch issued in a security bulletin last year (MS02-050). If the new patch is installed and MS02-050 is not in place, client-side certificates will be rejected.

The bulletin is one of two issued by Microsoft on Wednesday. The other bulletin deals with a moderate denial-of-service threat to Windows NT 4.0 and Windows 2000.

That bulletin is available here:

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Basic Authentication Extended to 2H 2021 for Exchange Online Users

    Microsoft is now planning to disable Basic Authentication use with its Exchange Online service sometime in the "second half of 2021," according to a Friday announcement.

  • Microsoft Offers Endpoint Configuration Manager Advice for Keeping Remote Clients Patched

    Microsoft this week offered advice for organizations using Microsoft Endpoint Configuration Manager with remote Windows systems that need to get patched, and it also announced Update 2002.

  • Azure Edge Zones Hit Preview

    Azure Edge Zones, a new edge computing technology from Microsoft designed to enable new scenarios for developers and partners, emerged as a preview release this week.

  • Microsoft Shifts 2020 Events To Be Online Only

    Microsoft is shifting its big events this year to be online only, including Ignite 2020.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.