Slashdot Mirror
Microsoft Downplays IIS Bug Threat
snydeq writes "Microsoft confirmed that its IIS Web-server software contains a vulnerability that could let attackers steal data, but downplayed the threat, saying 'only a specific IIS configuration is at risk from this vulnerability.' The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."
The default?
Is Microsoft 'correct' in downplaying, in the sense that the particular vulnerable configuration mentioned is not used by many?
'only a specific IIS configuration is at risk from this vulnerability.'
In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"
since ~70% of the hits on a quick google are how to turn on and configure WebDAV. But this also means that there seems to be a good bit of interest in using it...
This is really not a typically configuration for an outward facing site. Acting like this is some great find and "game over" scenario is a little far fetched. "Downplay" is flamebait in this context. But, it does make a good m$ bashing opportunity!
-- if you mod me down, I will become more powerful than you can possibly imagine
See http://milw0rm.com/exploits/8704.
One that isn't installed.
Nasa downplays ISS bug.
Say NO to unpaid Internships!
http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
Several news stories seem to allude that Microsoft is artificially downplaying the threat, citations of myself are used to underline the headline in an "us against Microsoft" kind of way. I want to clarify that I have the utmost respect of the MSRC team and I don't suspect Microsoft to willingly downplay anything. They also claim I am from Belgium, I am obviously from Luxembourg. The bug also is not the same as the IIS4/5 one, it's root cause is similar. That's about it.
To Whom It May Be Concerned:
Warner Bros., in an ill-advised attempt to promote Terminator Salvation, created a Skynet virus which aims to take over the world.
For some reason, it targets IIS.
We're doomed. Please head to the bomb shelter and the world will start again with a base of Microsoft employees.
thank you,
Management
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
I posted yesterday in reply to someone yesterday I wrote, after he gave a list of multinational corporation products we would "miss" if we didn't have them, that there are damn few products that have to be made by a big corporation, especially given the Internet and the technology available to us now as opposed to 25 or 30 years ago.
I think you can take that further and say there are a lot of products that can be made a hell of a lot better by a smaller company rather than a multi-national. If that weren't the case, why would we see so many cases of huge corporations that have to spin off or have to set up semi-autonomous units in order to make good quality products.
Also the definition of "big corporation" is HAZY right now methinks. We should probably be defining "big" these days as in number of dollars or as number of countries. The same tech that makes it possible for small companies to compete on an large scale allows big companies to work with small numbers of workers. "Big" companies don't need the unwashed masses like they used to; they can easily be multi-billion with a relative handful of people. Especially in the US, where the only business model there seems to be right now is 1)buy from overseas 2)sell at huge markup 3)PROFIT!!
This is the kid of news that always put a smile on my face.
It's reassuring to know that hackers have plenty to entertain themselves with windows servers, letting my Linux boxes alone.
Serious question, has the Apache package even had any bad vulnerabilities like this in the past ten years?
Change is certain; progress is not obligatory.
Anything Microsoft related on Slashdot forums is automatically flamebait because of the emotional reactions the mere word 'Microsoft' triggers in so many Slashdotters which makes it unpossible to have a proper serious, well thought out debate. Just look at the replies it's getting. It's pathetic huh.
The revolution will not be televised... but it will have a page on Wikipedia
Anyone using the exploit is prompted repeatedly about whether they really, really want to do it.
Geez. Don't you people know anything about Windows security?
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
Are you implying that no other operating system has bugs, or that open source guarantees bug free code? I'm pretty sure you'd be wrong.
(Disclaimer: I love Linux and have been using it at home for years, but I'm sure as hell not going to go around and tell everyone that it's rock solid and bug free just because it's open and I like it.)
This attitude (open implies better) is what I call faith based IT.
They also claim I am from Belgium, I am obviously from Luxembourg.
I used to work at a US office of a large French company, so I have some insights into this statement that might not be apparent to the typical American. Consider this as if he had said:
They also claim I am from Alabama. I am obviously from Tennessee.
and you'll have a rough idea of what he is saying and why he doesn't like it to be said that he's from Belgium.
That sounded dangerously close to being pro-Microsoft, comrade...
I never said that, but what I'm implying and is true with out a doubt is that closed source has more bugs!
What, because emotional hysteria is the necessary defence for Microsoft's evils in the world? If we aren't angry and if we don't hate, then MS wins???
The revolution will not be televised... but it will have a page on Wikipedia
What, because emotional hysteria is the necessary defence for Microsoft's evils in the world? If we aren't angry and if we don't hate, then MS wins???
See ? You got it in the end.
"This is really not a typically configuration for an outward facing site"
How do you know this, is IIS shiped by default with this 'safe' configuration?
"the flaw is currently being exploited in online attacks, according to CERT", and according to theReg, Ball State University was hacked using this exact same exploit.
'Shortly after the attack, students checking their iWeb pages were greeted with a message that said they had been hacked'
davecb5620@gmail.com
It sounds like the basic cause is something attempting to translate a string into "unicode" before using it.
For some reason, normally intelligent programmers turn into complete morons when presented with UTF-8 and other Unicode encodings. They become convinced that it is somehow physically impossible to do anything to these strings without first finding all the "characters" (actually Unicode code points, which are not "characters") and will write pages and pages of elaborate and bug-prone code to do this and "count characters". This code is COMPLICATED and there is the basic fact that the mapping is often not 1:1 and even when it is different implementations vary and thus don't invert correctly. This causes bugs, nasty ones like you can see right. here.
In fact it would be trivial to just treat it as a string of bytes that happens to maybe represent some text. The ONLY time you need "characters" is when you are rendering the string into an image that humans will look at, and if you want to do semantic analysis such as grammar checking. It is not needed if you are looking for the period that starts the extension or trying to find a number.
What is really sad and mysterious is that this disease only seems to be triggered by UTF-8. Nobody worries about finding the boundaries between "words". Nobody seems to worry about UTF-16 surrogate pairs, and nobody was really concerned with older Japanese multi-byte encodings.
This is NOT Microsoft-specific so don't feel complacent. Microsoft's moronic decision to name files with UTF-16 is really bad, but witness open source Python 3.0 which has decided that all strings will have to be converted to "unicode" (acutally UTF-16 or UTF-32 depending on the platform) before anything is done to them. Python is heavily used to parse HTML and URLs and I expect a huge mess from this stupid idea.
I'm sure there will be a few responses claiming some magical property of "characters" so that you can't do anything about it. PLEASE, try some thought experiments. Try substituting "words" in your example, it will either be stupid, or you will realize that that only a tiny portion of software needs it. Go and write some code where you leave the strings in UTF-8 and maybe you will learn.
Really? What's your evidence for that statement?
And this is why you shouldn't store username & password to the sql server in a connection string in web.config. Use Windows/AD authentication, which you should have used anyway.
How man bugs exist in OpenBSD, 2, there have been 2 patches ever needed for OpenBSD. How many has there been for Windows I think you need a big scale lets see
16 log etc...
But you want to talk Linux fine, I can play
Linux is know industry wide for having better security and stability, Linux is far more user friendly then Windows because the user has the code. Linux has better memory management, a better kernel, less viruses, less spyware, less malware etc... Do I need to keep going.
you might try to tell me you can't use Memory management as a fact well actually I can. The problems with closed source software usally exist right down to the base and if the base of any OS is the kernel then it fair game.
How many times have you had a Linux box freeze out of no where and for no reason, I've actually never seen it happen, How many times has Linux has memory fault. It's rare very very rare. Okay on the other side, Windows freezes from just moving your mouse to fast or a cd misreading and almost everything else that would or could happen with a computer. Thanks to Windows 7 we now have the blue screen back. Okay so I proved that.
Mac you say, fine I'll deal myself a win. Mac is closed source and hmmm already has viruses! Interesting, it has more security bugs then Linux / Unix and it has a higher rate of crashing.
Well I think I did my part and proved my point, so lets see what you come up with this time. And once again my Valid and very correct point closed source = more bugs and patches.