Slashdot Mirror
Millions of Websites Affected By Unpatched Flaw in Microsoft IIS 6 Web Server (pcworld.com)
A proof-of-concept exploit has been published for an unpatched vulnerability in Microsoft Internet Information Services 6.0, a version of the web server that's no longer supported but still widely used. From a report on PCWorld: The exploit allows attackers to execute malicious code on Windows servers running IIS 6.0 with the privileges of the user running the application. Extended support for this version of IIS ended in July 2015 along with support for its parent product, Windows Server 2003. Even so, independent web server surveys suggest that IIS 6.0 still powers millions of public websites. In addition, many companies might still run web applications on Windows Server 2003 and IIS 6.0 inside their corporate networks, so this vulnerability could help attackers perform lateral movement if they access such networks through other means.
Why would someone run a Microsoft web server vs. Nginx on OpenBSD?
Just asking, cuz I honestly can't fathom a situation where this would be desirable??? Maybe I'm missing something?
Extended support finished 2 years ago yet apparently there are still many admins (I used that term advisedly) running public facing websites who think its perfectly acceptable to run this software. This is beyond moronic but short of giving them all a royal kick up the backside I can't see a solution unless the companies involved fancy paying MS $$$ for a fix just for them.
independent web server surveys suggest that IIS 6.0 still powers millions of public websites
Whaa?? Who runs a public web site on a 14-year old version of the server???? That site claims 8 million of them!
But that's what you get for choosing a MS product.
As comparison: apache moved on to apache2 but you can still run apache(1) if you choose to, no matter the OS.
Its worse enough having to upgrade your servers to a new OS every few years. Its even worse to upgrade all web and database stuff to newer and usually not backward compatible stuff.
Only idiots think 5 years is a long time. Plenty stuff out there survives a few decades. Its not the new and shiny stuff that rules the cyberspace world but more often than not the ancient rusty but oiled cogwheels.
If you're running a website on IIS you deserve to be hacked.
Use. Linux.
aaaaaaa
I suppose you've never used ASP.NET or C# or .NET at any point.
Well, it turns out that they're actually quite good. Their biggest drawback, until recently, was that they were only supported on Windows.
But in terms of functionality, they're even still lightyears ahead of anything the open source community has managed to create.
ASP.NET is a sane, sensible way of building large-scale web applications and web APIs. It provides useful abstractions, but without going totally overboard like so many Java web frameworks do. You won't be drowned in design pattern hell. But it also provides more structure than most PHP frameworks provide. Yet it isn't as inflexible and opinionated as Ruby on Rails is. It's as close as anyone has gotten to a practical balance.
C# is an excellent programming language. It took the best parts of languages like Java and C++, but discarded a lot of their failures. It's a much, much, much better language than PHP or Ruby or JavaScript. It has a great blend of strictness where it's useful, but while also being extraordinarily flexible when that's needed. .NET as a runtime is fast, light and performs very well. It puts the JVM to shame, and it blows the various Ruby and JavaScript interpreters/VMs to pieces. It also includes a complete and sane standard library. The only other library I've ever seen that comes close is Python's. It's hard to go back to Java's standard library after using .NET's, just because Java's ends up looking so inconsistent and dumb so much of the time.
Microsoft does a lot wrong, but ASP.NET, C# and .NET are some things that they've done so much better than anyone else, and nobody has caught up yet. The open source communities are still dicking around with PHP, Ruby on Rails, and worst of all, Node.js, none of which are anywhere near as good as what Microsoft has created.
Now we're seeing Microsoft port these technologies to Linux and macOS, which gets rid of their main drawback: the need for Windows.
Aside from using legacy applications, it's getting to the point where technologies like Ruby on Rails, PHP and Node.js should be seen as obsolete, as the cross-platform technologies Microsoft is now providing are so much better.
Like the question why do some still use Windows XP? Well the answer is the same, it works and so why change and spend money when it works. Lot's of old hardware still chugging along and probably not well maintained either. Frankly this ideal linux would be any different if your using old unsupported code is not understanding the problem. Its the fact nobody is doing anything that's the problem. Sure they could switch to a modern linux server, could upgrade. Lot of old tech out there and many reasons why it is.
Well yeah they are rock solid. I left IIS a very long time ago as I realized what an insecure piece of crap it was.
WebDAV isn't enabled by default on IIS 6.0, nor is it a dependency of any of the major dynamic content generating extensions like ASP.NET. So the number of actual sites affected by this should be relatively limited.
IIS 6.0 is 14 years old and no longer under support. NIST lists 10 vulnerabilities targeting IIS 6.0 (including major extensions) in all that time, including this one. That's a damned good track record.
No sympathy or pity for the owners of these systems. You don't expose unsupported operating systems or applications to the public internet.
As a reference on how outdated this is, I believe this OS was contemporary to the 2.6 kernel---which is also no longer maintained.
Hopefully, if services are down/degraded, their customers will understand how this problem was---and drop them.
The security on XP/2003 was very modest by modern standards, so everyone should have upgraded a long time ago. Enterprise should be migrating to Windows 8/10 or Server 2012/2016.
It seems like the upsides of running an IIS/Windows stack were SO MUCH more than the downsides that people actively stick to using it, even if it means using an older buggier unsupported version...
Problem is the guys in suits. Not the geeky admin. Unless there is a ROI it won't ever be upgraded. They work fine. Worse if they outsource to India to cut costs. These contract companies care more to appear cheap and brown nose their MBA clients than fix shit.
I left my last employer. One of the biggest but not sole reason was their shit never worked and I was always blamed. We have HIPPA requirements and freaking run them off IE 6 and store files on server 2003! Worse I replaced the tape drives 3 times because they are 11 years old. I was to blame for reliability, performance, and security. Document shit you get a write up. The MBAs need to make the client happy so shut up etc.
IT wasn't always considered a cost sink like it is today. The great recession really swung the pendulum too far in the other direction from 1999 in the good old days. It's time it swung back and failing insecure infrastructure mixed with IT geeks quiting might swing it back
http://saveie6.com/
Don't run WebDAV on IIS 6.0. If you have not stopped already, stop now. Ok, all fixed, now, back to security.
Most efficient ad & threat blocker there is
APK Hosts File Engine 9.0++ SR-5 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads & malware rob speed, security & privacy
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively
Host&s stops all traffic even better than a fierwall to unknown hosts and ports all while us less powr
Hosts better than AV at detecting malicious software and stop$ in tracks
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity
* Using what you already NATIVELY have, built into your TCP/IP stack running in FASTOR kernelmode!
Able to keep Grandm4 and you kid sister out of your porn stash
Generate nightly when I sodomize my cat
So simple it won't actually provide any protectin that a small child couldn't get around
APK
P.S. - Safe because it will only keep script kiddies at bay on the best day
Most efficient ad & threat blocker there is
APK Hosts File Engine 9.0++ SR-5 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads & malware rob speed, security & privacy
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively
Host&s stops all traffic even better than a fierwall to unknown hosts and ports all while us less powr
Hosts better than AV at detecting malicious software and stop$ in tracks
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity
* Using what you already NATIVELY have, built into your TCP/IP stack running in FASTOR kernelmode!
Able to keep Grandm4 and you kid sister out of your porn stash
Generate nightly when I sodomize my cat
So simple it won't actually provide any protection that a small child couldn't get around
APK
P.S. - Safe because it will only keep script kiddies at bay on the best day
Serious question. What did Microsoft screw up so badly that nobody ever upgraded to a "better" (?) or more secure server?
See subject: You're reduced to impersonating me w/ bogus posts (or downmodding my real posts) & can't prove me wrong technically so yes, I am winning. 2nd time today was here too loser https://yro.slashdot.org/comments.pl?sid=10435839&cid=54153797/ & I catch them all - you can't win (I do because you always lose, loser).
APK
P.S.=> Thanks whoever you are impersonating me - you're tipping your hand you can't get the better of me... apk
act like a slave, get treated like a slave. windows users deserve every hack they get. stupid fucks.