Microsoft Issues Security Alert on IIS Web Server

Responding to public reports of a wild bug, Microsoft on late Monday issued a security advisory to address a potential vulnerability in its Internet Information Services (IIS) Web server software.

Redmond said that the vulnerability, which has elevation of privilege implications, pertains to IIS versions 5.0, 5.1 and 6.0. The software giant added that it wasn't aware at this time of any "known attacks" against IIS, but is investigating the matter. IIS is the world's most frequently used Web server, after Apache HTTP server.

Independent security researchers first uncovered evidence of the bug late last week. On Monday, the U.S. Computer Emergency Readiness Team (U.S. CERT) confirmed that there were indeed threats to IIS.

In its advisory, Microsoft identified three "mediating factors" that can serve as workarounds for the vulnerability until its own investigation is concluded and a new patch is issued.

First, Microsoft recommends that system administrators maintain file system access control lists (ACL) that are solid and enforceable. With a clamp down on access control security, the elevation of privilege problem is lessened. Microsoft explains that under such conditions, "this vulnerability cannot be used to exceed the level of access granted to the anonymous user account through file system ACLs."

The second workaround involves configuring orphan, anonymous or administrative user accounts to deny write, change or delete privileges by default. That way, an anonymously listed "SECADMIN" or "SYSADMIN" user profile can't be used against an organization.

The final mitigation trick involves disabling Web-based distributed authoring and versioning (WebDAV). Microsoft's advisory says that this workaround particularly works for Windows Server 2003 systems running IIS 6.0. The advisory adds that for IIS 6.0, "WebDAV is not enabled in the default configuration" and unless enabled by an administrator, the system remains relatively unexposed.

Shavlik Technologies' Chief Technology Officer Eric Schultze offered one note of caution for IT pros studying this vulnerability.

"This flaw could enable attackers to read code pages on the Web server, where these pages might include usernames or passwords for applications or databases controlled by the Web server," Schultze said in a prepared statement. "I recommend people running IIS 5 or IIS 6 run the IIS lockdown and URLScan tools from Microsoft. Both of these tools disable WebDAV and will protect your system from this latest zero day."

Such vulnerabilities have appeared and been patched before in IIS. In February of 2008, Redmond issued two patches to address elevation of privilege and remote code execution bugs in IIS. Back then, it was said an attacker could take control of an IIS server by way of the Worker Process Identity application, which is preset with network admin account privileges by default.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft Previews New App Reporting and Consent Tools in Azure AD

    Microsoft last week described a few Azure Active Directory improvements for organizations wanting to connect their applications to Microsoft's identity and access service.

  • Free Software Foundation Asks Microsoft To Release Windows 7 Code

    The Free Software Foundation this week announced that it has established a petition demanding that Microsoft release its proprietary Windows 7 code as free software.

  • Managing Multiple Remote Connections in One Place with mRemoteNG

    If you're juggling multiple remote connections daily, this is the utility for you. Brien walks through the steps to use mRemoteNG, from installation to deployment.

  • Microsoft Unveils Plan To Push Bing to Office 365 ProPlus Users

    Microsoft on Tuesday unveiled plans to deliver an extension that will change the default search engine to Bing in both Google Chrome and Mozilla Firefox browsers for Office 365 ProPlus subscribers.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.