Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: IIS 7.5 0-Day DoS (processing FTP requests) - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
IIS 7.5 0-Day DoS (processing FTP requests)

* 16:04 PM CST 12/22/10 by jcb *

A 0-day exploit has been published at exploit-db (see US-Cert advisory) that takes advantage of a memory corruption vulnerability in IIS 7.5's FTP service.  This bug will work pre-authentication.

From the looks of it, it is a pure remote exploit that's chief use would be denial of service.  As with any memory corruption bugs, it is theoretically possible to use this to gain access to the server with the permissions of the user that is running IIS.  I think that would be difficult in this case, but time will tell.  It is, nevertheless, a serious bug that at present has no patch.  (As of this writing, Microsoft hasn't confirmed it is an issue).

Some defenses would be limiting FTP services that are internet-facing (especially if IIS), using firewalls to limit access to the server and configuring perimeter devices to check for memory attacks. 

More details will be published here as we have them.

John Bambenek
bambenek at gmail /dot/ com


262 Posts
ISC Handler
Dec 22nd 2010
Confirmed by MS:

Sign Up for Free or Log In to start participating in the conversation!