A hacker has posted code that could be used to take over a system running Microsoft IIS (Internet Information Services) server.
The software, which was posted to the Milw0rm Web site on Monday, could be a big problem for some webmasters, however the attack appears to work only on older versions of Microsoft's products. It was not immediately clear how many versions of Microsoft's products are vulnerable to the attack, and Microsoft did not immediately respond to requests for more information on the issue.
[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]
The flaw lies in the FTP software used by IIS to move large files around the Internet, so the victim would have to have FTP enabled in order to be vulnerable to the attack. According to the Milw0rm post, an attacker could use this code to install unauthorized software on the server.
According to the Milw0rm poster, the code works on Microsoft's decade-old Windows 2000 operating system, while running the older IIS 5.0 server. For the attack to work, the hacker would also need to be able to create a directory on the server, security experts say.
Other versions of IIS are also at risk, according to Thierry Zoller, an independent researcher who has studied the issue. However, newer versions of Microsoft's operating systems have features that make it less serious, he added via instant message.
Get the independent advice and expertise you need to support a virtual workforce.
The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Read this 2 page white paper now to learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.
Download now »
Ensuring acceptable application delivery will become even more difficult over the next few years. As a result, IT organizations need to ensure that the approach that they take to resolving the current application delivery challenges can scale to support the emerging challenges. This handbook elaborates on the key tasks associated with planning, optimization, management and control and provides decision criteria to help IT organizations choose appropriate solutions.
Download now »
A common misconception is that mid-range storage requirements are dramatically different than that of a larger enterprise. Mid-range storage users may require less capacity, but they have similar functionality and management requirements. This ESG paper examines mid-range storage needs and reviews a new solution that adjusts size while retaining value, performance and functionality.
Download now »
Sign up to receive InfoWorld Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
15 Recommendations
