* 16:04 PM CST 12/22/10 by jcb *

A 0-day exploit has been published at exploit-db (see US-Cert advisory) that takes advantage of a memory corruption vulnerability in IIS 7.5's FTP service.  This bug will work pre-authentication.

From the looks of it, it is a pure remote exploit that's chief use would be denial of service.  As with any memory corruption bugs, it is theoretically possible to use this to gain access to the server with the permissions of the user that is running IIS.  I think that would be difficult in this case, but time will tell.  It is, nevertheless, a serious bug that at present has no patch.  (As of this writing, Microsoft hasn't confirmed it is an issue).

Some defenses would be limiting FTP services that are internet-facing (especially if IIS), using firewalls to limit access to the server and configuring perimeter devices to check for memory attacks. 

More details will be published here as we have them.

--
John Bambenek
bambenek at gmail /dot/ com

Update

Microsoft has provided a response to this issue through their Security Research & Defense blog. Ottmar has a comment linking to the page (thanks), but just in case you aren't reading comments here is the link http://blogs.technet.com/b/srd/archive/2010/12/22/assessing-an-iis-ftp-7-5-unauthenticated-denial-of-service-vulnerability.aspx 

Mark H