Slashdot Mirror
Microsoft Downplays IIS Bug Threat
snydeq writes "Microsoft confirmed that its IIS Web-server software contains a vulnerability that could let attackers steal data, but downplayed the threat, saying 'only a specific IIS configuration is at risk from this vulnerability.' The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."
The default?
Is Microsoft 'correct' in downplaying, in the sense that the particular vulnerable configuration mentioned is not used by many?
'only a specific IIS configuration is at risk from this vulnerability.'
In my head I keep hearing, "don't use webDAV, use Exchange and SharePoint!"
This is really not a typically configuration for an outward facing site. Acting like this is some great find and "game over" scenario is a little far fetched. "Downplay" is flamebait in this context. But, it does make a good m$ bashing opportunity!
-- if you mod me down, I will become more powerful than you can possibly imagine
See http://milw0rm.com/exploits/8704.
One that isn't installed.
http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
Several news stories seem to allude that Microsoft is artificially downplaying the threat, citations of myself are used to underline the headline in an "us against Microsoft" kind of way. I want to clarify that I have the utmost respect of the MSRC team and I don't suspect Microsoft to willingly downplay anything. They also claim I am from Belgium, I am obviously from Luxembourg. The bug also is not the same as the IIS4/5 one, it's root cause is similar. That's about it.
To Whom It May Be Concerned:
Warner Bros., in an ill-advised attempt to promote Terminator Salvation, created a Skynet virus which aims to take over the world.
For some reason, it targets IIS.
We're doomed. Please head to the bomb shelter and the world will start again with a base of Microsoft employees.
thank you,
Management
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
Serious question, has the Apache package even had any bad vulnerabilities like this in the past ten years?
Change is certain; progress is not obligatory.
Anything Microsoft related on Slashdot forums is automatically flamebait because of the emotional reactions the mere word 'Microsoft' triggers in so many Slashdotters which makes it unpossible to have a proper serious, well thought out debate. Just look at the replies it's getting. It's pathetic huh.
The revolution will not be televised... but it will have a page on Wikipedia
Anyone using the exploit is prompted repeatedly about whether they really, really want to do it.
Geez. Don't you people know anything about Windows security?
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
Fortunately they have got a Russian on board the space station.
"This is how we fix things on Russian space station!" --Lev Andropov
(He then proceeds to take a hammer and whack the equipment.)
Change is certain; progress is not obligatory.
It sounds like the basic cause is something attempting to translate a string into "unicode" before using it.
For some reason, normally intelligent programmers turn into complete morons when presented with UTF-8 and other Unicode encodings. They become convinced that it is somehow physically impossible to do anything to these strings without first finding all the "characters" (actually Unicode code points, which are not "characters") and will write pages and pages of elaborate and bug-prone code to do this and "count characters". This code is COMPLICATED and there is the basic fact that the mapping is often not 1:1 and even when it is different implementations vary and thus don't invert correctly. This causes bugs, nasty ones like you can see right. here.
In fact it would be trivial to just treat it as a string of bytes that happens to maybe represent some text. The ONLY time you need "characters" is when you are rendering the string into an image that humans will look at, and if you want to do semantic analysis such as grammar checking. It is not needed if you are looking for the period that starts the extension or trying to find a number.
What is really sad and mysterious is that this disease only seems to be triggered by UTF-8. Nobody worries about finding the boundaries between "words". Nobody seems to worry about UTF-16 surrogate pairs, and nobody was really concerned with older Japanese multi-byte encodings.
This is NOT Microsoft-specific so don't feel complacent. Microsoft's moronic decision to name files with UTF-16 is really bad, but witness open source Python 3.0 which has decided that all strings will have to be converted to "unicode" (acutally UTF-16 or UTF-32 depending on the platform) before anything is done to them. Python is heavily used to parse HTML and URLs and I expect a huge mess from this stupid idea.
I'm sure there will be a few responses claiming some magical property of "characters" so that you can't do anything about it. PLEASE, try some thought experiments. Try substituting "words" in your example, it will either be stupid, or you will realize that that only a tiny portion of software needs it. Go and write some code where you leave the strings in UTF-8 and maybe you will learn.