I've been testing plugin 11412 against a Windows 2000 machine with SP3 applied but without the MS03-007 patch.
When I run 11412 against it, IIS turns up its toes and dies completely. It does NOT restart itself as the comments in the plugin indicate. If you now go to the IIS GUI and look at properties for the web pages then when you exit the properties page it comes up with a prompt that says it is unable to contact the default web page and asks if you would like to restart it. But it seems to wait until you take some action on the GUI before it issues this message (we waited 5 minutes or so before we attempted to do anything on the IIS server once the scan had completed).
Looks to me like this should be reclassified as ACT_DESTRUCTIVE_ATTACK and use safe_checks().
Maybe there's an IIS option that says "restart yourself automatically on failure" but a (very) cursory look through the settings didn't show anything that jumped out at us.
It's under Services. If you check out the properties under the World Wide Web Publishing Service, you'll see a tab for Recovery. There you'll see options to take for first, second, and third failures. The options are take no action, restart the service, run a file, or reboot the computer. You can also set how long (in days) for the failure count to reset.
Michael Katz
[EMAIL PROTECTED]
Procinct Security
