Slashdot Mirror

← Back to Stories (view on slashdot.org)

WebDAV Buffer Overflow Attack Compromises IIS 5.0

Posted by timothy on from the what-this-old-thing dept.

rf0 writes "Well CERT is reporting a new overflow attack for IIS 5.0. Microsoft has released a bulletin. Better download those patches and fix another security hole." According to this CNET story, Microsoft says that this is already being exploited, at the very least since last Wednesday.

5 of 367 comments (clear)

  1. I am kind of impressed by obotics · · Score: 5, Interesting
    Wow! Microsoft already has a patch released? Not bad at all!

    Well, if they are going to have bugs, it is not that bad of a thing as long as they are patched promptly. Then again, many admins do have a tendancy to run unpatched machines.

  2. A quite-interesting report on MSNBC by expro · · Score: 4, Interesting

    It seems quite likely to me that that was an under-reported version of this incident reported on MSNBC, that permitted an intruder with apparent quite-hostile intent onto US Army sites.

  3. What aspects of URLScan provide protection by mattsouthworth · · Score: 4, Interesting

    I've asked this everywhere, maybe someone will answer.

    The MS advisory states that a 'default' URLScan will protect against this. Well ... We don't run the default config. We've customized it, as have many shops. I can't find information on _which_ aspects of URLScan provide the protection - I'd like to know if our customizations have left us out in the breeze.

    Anyone know?

  4. Re:Ugh by Mexican · · Score: 5, Interesting

    Is it just me, or did anyone happen to download and extract the patch and notice that it does not seem to contain the webdav .dll but just ntdll.dll? So is it really a patch to WebDav or for something in ntdll.dll that webdav relies on?

  5. Slight problem with that by Groo+Wanderer · · Score: 5, Interesting

    The problem with this patch is that it wasn't found by a white hat and submitted. It was discovered by people getting hacked and calling MS asking WTF. In cases like that, 5 days isn't really that bad. In cases where an exploit, along with vulnerability code, and a description are fed to devs on a platter, open source or not, it makes the task 10x easier. When you have to figure out what is going on while under fire, and in a hurry, things get messy. That said, you can hack a lot of systems in 5 days with the right script.

    -Charlie