Slashdot Mirror
Microsoft Downplays IIS Bug Threat
snydeq writes "Microsoft confirmed that its IIS Web-server software contains a vulnerability that could let attackers steal data, but downplayed the threat, saying 'only a specific IIS configuration is at risk from this vulnerability.' The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."
The default?
...although they use an IIS server with a modified header to make it look like Apache, slashdot.org has been reported 'probably' not at risk since nobody understands its unicode support anyway.
Non-Linux Penguins ?
Is Microsoft 'correct' in downplaying, in the sense that the particular vulnerable configuration mentioned is not used by many?
'only a specific IIS configuration is at risk from this vulnerability.'
In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"
since ~70% of the hits on a quick google are how to turn on and configure WebDAV. But this also means that there seems to be a good bit of interest in using it...
I think the story of big is a lie, and I see it all the time in "big" corporations. Employing thousands, and having revenues of billions of dollars make you look "big" but in reality they are incapable of doing very basic things, maybe their "big" body paralizes themselves, but that does not change the truth.
While most of the companies dream to be one of these "big" ones, they miss that they are much more helpful to their customers when they are "small", because I never got ignored by a small company I worked with about a bug in their service, and moreover they quickly fixed or showed me a work around it quickly.
And what we see with "big" ones? Posted company Microsoft, knows the problem, they have money, and manpower to fix it. Or that's what we believe in. At the end, what we see is, their 'capability' is such a big lie and only hidden behind the images we're supposed to believe.
This economic crisis made me think more about the concept of "big". I see lots of "big" companies these days, laying of people as if their employees are member of flocks that they wanted to butcher. It's not their bussinesses that drives them but the numbers and 'analysists'. I mean, think about Lehman Brothers, and how in the earth you think of something to be "big", if it collapsed in just a single year. Who can't claim same thing won't happen for "big" companies in IT industry. Now I belive that "big corporations" are just projections of small companies together which does hell lot of better job than the leeches they serve for.
This is really not a typically configuration for an outward facing site. Acting like this is some great find and "game over" scenario is a little far fetched. "Downplay" is flamebait in this context. But, it does make a good m$ bashing opportunity!
-- if you mod me down, I will become more powerful than you can possibly imagine
See http://milw0rm.com/exploits/8704.
One that isn't installed.
Nasa downplays ISS bug.
Say NO to unpaid Internships!
http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
Several news stories seem to allude that Microsoft is artificially downplaying the threat, citations of myself are used to underline the headline in an "us against Microsoft" kind of way. I want to clarify that I have the utmost respect of the MSRC team and I don't suspect Microsoft to willingly downplay anything. They also claim I am from Belgium, I am obviously from Luxembourg. The bug also is not the same as the IIS4/5 one, it's root cause is similar. That's about it.
To Whom It May Be Concerned:
Warner Bros., in an ill-advised attempt to promote Terminator Salvation, created a Skynet virus which aims to take over the world.
For some reason, it targets IIS.
We're doomed. Please head to the bomb shelter and the world will start again with a base of Microsoft employees.
thank you,
Management
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
The entire OS has this kind of bug, it's simple closed source, closed mind, open bugs. I don't want to rag but are we surprised. Now we have to wait for them to fix the bug which is going to involve getting a patch. Knowing how poorly Windows is designed someone will crack the patch to get access which will need a patch and so on.
It's a really simple formula, Windows = Broken or in c code, Windows == Broken, there is always a patch, a bug, a hole or an excuse. Come on Microsoft test your software.
Thanks
LinuxOverWindows
This is the kid of news that always put a smile on my face.
It's reassuring to know that hackers have plenty to entertain themselves with windows servers, letting my Linux boxes alone.
Serious question, has the Apache package even had any bad vulnerabilities like this in the past ten years?
Change is certain; progress is not obligatory.
Anyone using the exploit is prompted repeatedly about whether they really, really want to do it.
Geez. Don't you people know anything about Windows security?
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
They also claim I am from Belgium, I am obviously from Luxembourg.
I used to work at a US office of a large French company, so I have some insights into this statement that might not be apparent to the typical American. Consider this as if he had said:
They also claim I am from Alabama. I am obviously from Tennessee.
and you'll have a rough idea of what he is saying and why he doesn't like it to be said that he's from Belgium.
"This is really not a typically configuration for an outward facing site"
How do you know this, is IIS shiped by default with this 'safe' configuration?
"the flaw is currently being exploited in online attacks, according to CERT", and according to theReg, Ball State University was hacked using this exact same exploit.
'Shortly after the attack, students checking their iWeb pages were greeted with a message that said they had been hacked'
davecb5620@gmail.com
It sounds like the basic cause is something attempting to translate a string into "unicode" before using it.
For some reason, normally intelligent programmers turn into complete morons when presented with UTF-8 and other Unicode encodings. They become convinced that it is somehow physically impossible to do anything to these strings without first finding all the "characters" (actually Unicode code points, which are not "characters") and will write pages and pages of elaborate and bug-prone code to do this and "count characters". This code is COMPLICATED and there is the basic fact that the mapping is often not 1:1 and even when it is different implementations vary and thus don't invert correctly. This causes bugs, nasty ones like you can see right. here.
In fact it would be trivial to just treat it as a string of bytes that happens to maybe represent some text. The ONLY time you need "characters" is when you are rendering the string into an image that humans will look at, and if you want to do semantic analysis such as grammar checking. It is not needed if you are looking for the period that starts the extension or trying to find a number.
What is really sad and mysterious is that this disease only seems to be triggered by UTF-8. Nobody worries about finding the boundaries between "words". Nobody seems to worry about UTF-16 surrogate pairs, and nobody was really concerned with older Japanese multi-byte encodings.
This is NOT Microsoft-specific so don't feel complacent. Microsoft's moronic decision to name files with UTF-16 is really bad, but witness open source Python 3.0 which has decided that all strings will have to be converted to "unicode" (acutally UTF-16 or UTF-32 depending on the platform) before anything is done to them. Python is heavily used to parse HTML and URLs and I expect a huge mess from this stupid idea.
I'm sure there will be a few responses claiming some magical property of "characters" so that you can't do anything about it. PLEASE, try some thought experiments. Try substituting "words" in your example, it will either be stupid, or you will realize that that only a tiny portion of software needs it. Go and write some code where you leave the strings in UTF-8 and maybe you will learn.
And this is why you shouldn't store username & password to the sql server in a connection string in web.config. Use Windows/AD authentication, which you should have used anyway.