----- Original Message ----- From: "X-Force" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, March 17, 2003 12:12 PM Subject: ISS Security Brief: Microsoft IIS WebDAV Remote Compromise Vulnerability
> -----BEGIN PGP SIGNED MESSAGE----- > > Internet Security Systems Security Brief > March 17, 2003 > > Microsoft IIS WebDAV Remote Compromise Vulnerability > > Synopsis: > > A serious vulnerability exists within the WebDAV component of Microsoft > Internet Information Services (IIS) Web server. WebDAV stands for "Web-based > Distrbuted Authoring and Versioning". WebDAV extensions are used by > administrators to manage and edit Web content remotely. WebDAV is enabled by > default on IIS 5 installations, and no authentication or special privileges > are required for remote exploitation. > > Impact: > > It is possible for remote attackers to run arbitrary code on vulnerable Web > servers. This vulnerability is currently being exploited in the wild, and > X-Force has verified the existence of a functional exploit tool. This > vulnerability is in itself very serious, but the existence of robust exploits > in the wild dictates that fixes or temporary workarounds should be applied > immediately. > > Although it is possible to disable WebDAV, doing so requires manually > creating a specific registry key. The IIS Lockdown Tool from Microsoft may > or may not turn off WebDAV, depending on the server template selected at > installation time. > > Affected Versions: > > IIS 5.0 on Windows 2000 up to and including Service Pack 3 > > Note: IIS installations on Windows XP, Windows Server 2003 are not affected. > > For the complete ISS X-Force Security Advisory, please visit: > http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=22029 > > ______ > > > About Internet Security Systems (ISS) > Founded in 1994, Internet Security Systems (ISS) (Nasdaq: ISSX) is a > pioneer and world leader in software and services that protect critical > online resources from an ever-changing spectrum of threats and misuse. > Internet Security Systems is headquartered in Atlanta, GA, with > additional operations throughout the Americas, Asia, Australia, Europe > and the Middle East. > > Copyright (c) 2003 Internet Security Systems, Inc. All rights reserved > worldwide. > > Permission is hereby granted for the electronic redistribution of this > document. It is not to be edited or altered in any way without the > express written consent of the Internet Security Systems X-Force. If you > wish to reprint the whole or any part of this document in any other > medium excluding electronic media, please email [EMAIL PROTECTED] for > permission. > > Disclaimer: The information within this paper may change without notice. > Use of this information constitutes acceptance for use in an AS IS > condition. There are NO warranties, implied or otherwise, with regard to > this information or its use. Any use of this information is at the > user's risk. In no event shall the author/distributor (Internet Security > Systems X-Force) be held liable for any damages whatsoever arising out > of or in connection with the use or spread of this information. > X-Force PGP Key available on MIT's PGP key server and PGP.com's key server, > as well as at http://www.iss.net/security_center/sensitive.php > Please send suggestions, updates, and comments to: X-Force > [EMAIL PROTECTED] of Internet Security Systems, Inc. > > > > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQCVAwUBPnYPtTRfJiV99eG9AQGapQP+LNyH2y4dRLJBMJ+AVK5x01ZjuojVj50o > zkb+APAJqBadrnrV8PwRXwzC4G1P4CjqHLPnN0xUQbKnGCWgpC9aaM31k5jH2cyP > LYmIR4QPe9MprXPDKaYYtrFk5qdnxlaM2SsB+Hbq+C0bn3AOEUZVlQB0jQ8/WdU2 > KGaqiXvws0o= > =6bDY > -----END PGP SIGNATURE----- > --- > [This E-mail scanned for viruses by Declude Virus on the server aea5.k12.ia.us] > > --- [This E-mail scanned for viruses by Declude Virus on the server aea8.k12.ia.us] --------------------------------------------------------- Archived messages from this list can be found at: http://www.mail-archive.com/[EMAIL PROTECTED]/ ---------------------------------------------------------
