Microsoft Security Advisory: Vulnerability in IIS
section: microsoft, for your questions: KezNews forum, 19.5.2009
Tip: Click here to update all your PC's outdated driversMicrosoft is investigating new public reports of a possible vulnerability in Microsoft Internet Information Services (IIS). An elevation of privilege vulnerability exists in the way that the WebDAV extension for IIS handles HTTP requests. An attacker could exploit this vulnerability by creating a specially crafted anonymous HTTP request to gain access to a location that typically requires authentication.
We are not aware of attacks that are trying to use this vulnerability or of customer impact at this time. Microsoft is investigating the public reports.
We are actively working with partners in our Microsoft Active Protections Program (MAPP) and our Microsoft Security Response Alliance (MSRA) program to provide information that they can use to provide broader protections to customers.
Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
Mitigating Factors:
File system ACLs are enforced. This vulnerability bypasses the IIS configuration that specifies which authentication is allowed, but not the file system-based ACL check that verifies whether a file is accessible by a given user. A successful exploit of the vulnerability would still restrict the attacker to the permissions granted to the anonymous user account on file system ACL level. Therefore this vulnerability cannot be used to exceed the level of access granted to the anonymous user account through file system ACLs. The default anonymous user account is configured as the IUSR_ account.source:
microsoft.com
>> Click Here to Run a Free Scan for PC Errors <<
Send link 2 friend | Permalink
MORE RELATED ARTICLES:
Microsoft Baseline Security Analyzer 2.1.1 Vulnerability Scanner for Windows 7 and Windows Server 2008 R2 || Microsoft set to fix 17 year old Windows vulnerability next week || Windows has a 17 year old un-patched vulnerability || Security Tab Fixer for Windows XP - Activate Security Tab Under File, Folder Property Menu || Windows 7 RC Immune to 0-Day DirectX Vulnerability
Comments(2)
there's a vunerbility in ya fuqing brain kezmoran go find a job and dont infect other
peeps computers otherwise obama puts you shaved hiney in gitmo and let you rape by irakies
which is good :)
o8oihjoi
No new comments are allowed for this article.
For your questions use our KezNews Forum
Windows 7 RTM 7600.16385.090713-1255 HERE !
Go away put the site down idiot
By Chick narris on 20.05.2009 - 19:05