Microsoft: IIS 6.0 Has 'Inconsistencies,' but No Bug

Microsoft denied that its Internet Information Services (IIS) Web server software is subject to new-found security vulnerability.

The bug was first reported to Microsoft on Dec. 23, but Microsoft closed the investigation last week claiming that the potential problem isn't a vulnerability. Microsoft spokesperson Christopher Budd said in a Dec. 29 blog that there are some "inconsistencies" with IIS version 6.0, but no "new" exploits.

Details of the so-called vulnerability first surfaced on Christmas Day when security researcher Soroush Dalili posted findings on his personal blog. Dalili's assertion gained credence from third-party security company Secunia, which last updated its own findings on December 30.

Secunia explained that the IIS problem results from the Web server "incorrectly executing Active Server Page code in files with extensions separated by semicolons (e.g. 'file.asp;.jpg')." The security firm explained that this IIS bug "can be exploited to potentially upload and execute arbitrary ASP code via a third-party application using file extensions to restrict uploaded file types."

This discovery marked the third time in 2009 that IIS bugs or glitches have been identified. Microsoft's security researchers disagreed, saying that the exploit could only happen if the server was misconfigured to have both write and execute privileges, contrary to IIS 6.0 best practices for security. Budd suggested that Microsoft is considering changing IIS 6.0 to make its functionality more "in line with the other versions" of the Web server software.

"What we have seen is that there is an inconsistency in IIS 6 only in how it handles semicolons in URLs," Budd said in his post. "It's this inconsistency that the claims have focused on, saying this enables an attacker to bypass content filtering software to upload and execute code on an IIS server."

Dalili and Secunia explained the issue differently, saying that the real problem is that IIS can execute any extension as ASP code.

"By using this vulnerability, an attacker can bypass this protection and upload a dangerous executable file on the server," Dalili said in his post.

Budd suggested users should review Microsoft's best practices for IIS 6.0 security, particularly if the Web server is configured with both write and execute privileges on the same directory.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft Adds 6 More Months to Expiring Certification Programs

    Microsoft has announced an extension to the end date of three certification programs slated for retirement.

  • Microsoft's Surface Pro X: It's Like the Surface RT, But Better

    There's a lot about the Surface Pro X that's reminiscent of the ill-fated Surface RT. But despite the similarities, this might just be one of the rare cases where the sequel is better than the original.

  • Q&A: The Challenges of Securing All Those Newly Remote Workers

    Security expert Dale Meredith identifies cybersecurity challenges, best practices and major concerns resulting from all the employees forced into home offices by COVID-19.

  • Astronaut Survival Training: A Crash Course in Sea Survival

    Lots of things can go wrong during a commercial spaceflight -- especially once your capsule leaves space. An unplanned ocean landing is just one of those worst-case scenarios.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.