Microsoft Issues Security Alert on IIS Web Server

Responding to public reports of a wild bug, Microsoft on late Monday issued a security advisory to address a potential vulnerability in its Internet Information Services (IIS) Web server software.

Redmond said that the vulnerability, which has elevation of privilege implications, pertains to IIS versions 5.0, 5.1 and 6.0. The software giant added that it wasn't aware at this time of any "known attacks" against IIS, but is investigating the matter. IIS is the world's most frequently used Web server, after Apache HTTP server.

Independent security researchers first uncovered evidence of the bug late last week. On Monday, the U.S. Computer Emergency Readiness Team (U.S. CERT) confirmed that there were indeed threats to IIS.

In its advisory, Microsoft identified three "mediating factors" that can serve as workarounds for the vulnerability until its own investigation is concluded and a new patch is issued.

First, Microsoft recommends that system administrators maintain file system access control lists (ACL) that are solid and enforceable. With a clamp down on access control security, the elevation of privilege problem is lessened. Microsoft explains that under such conditions, "this vulnerability cannot be used to exceed the level of access granted to the anonymous user account through file system ACLs."

The second workaround involves configuring orphan, anonymous or administrative user accounts to deny write, change or delete privileges by default. That way, an anonymously listed "SECADMIN" or "SYSADMIN" user profile can't be used against an organization.

The final mitigation trick involves disabling Web-based distributed authoring and versioning (WebDAV). Microsoft's advisory says that this workaround particularly works for Windows Server 2003 systems running IIS 6.0. The advisory adds that for IIS 6.0, "WebDAV is not enabled in the default configuration" and unless enabled by an administrator, the system remains relatively unexposed.

Shavlik Technologies' Chief Technology Officer Eric Schultze offered one note of caution for IT pros studying this vulnerability.

"This flaw could enable attackers to read code pages on the Web server, where these pages might include usernames or passwords for applications or databases controlled by the Web server," Schultze said in a prepared statement. "I recommend people running IIS 5 or IIS 6 run the IIS lockdown and URLScan tools from Microsoft. Both of these tools disable WebDAV and will protect your system from this latest zero day."

Such vulnerabilities have appeared and been patched before in IIS. In February of 2008, Redmond issued two patches to address elevation of privilege and remote code execution bugs in IIS. Back then, it was said an attacker could take control of an IIS server by way of the Worker Process Identity application, which is preset with network admin account privileges by default.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • AzCopy Preview Adds AWS S3 Data Transfer Improvements

    Microsoft announced this week that it has improved the preview version of its AzCopy tool to better handle Amazon Web Services (AWS) S3 data.

  • Microsoft Adding Google G Suite Migration in Exchange Admin Center

    Microsoft's Exchange Admin Center will be getting the ability to move Google G Suite calendar, contacts and e-mail data over to the Office 365 service "in the coming weeks."

  • Qualcomm Back in Datacenter Fray with AI Chip

    The chip maker joins a crowded field of vendors that are designing silicon for processing AI inference workloads in the datacenter.

  • Microsoft To Ship Surface Hub 2S Conference Device in June

    Microsoft on Wednesday announced a June U.S. ship date for one of its Surface Hub 2S conferencing room products, plus a couple of other product milestones.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.