SANS ISC: IIS 7.5 0-Day DoS (processing FTP requests)

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

* 16:04 PM CST 12/22/10 by jcb *

A 0-day exploit has been published at exploit-db (see US-Cert advisory) that takes advantage of a memory corruption vulnerability in IIS 7.5's FTP service.  This bug will work pre-authentication.

From the looks of it, it is a pure remote exploit that's chief use would be denial of service.  As with any memory corruption bugs, it is theoretically possible to use this to gain access to the server with the permissions of the user that is running IIS.  I think that would be difficult in this case, but time will tell.  It is, nevertheless, a serious bug that at present has no patch.  (As of this writing, Microsoft hasn't confirmed it is an issue).

Some defenses would be limiting FTP services that are internet-facing (especially if IIS), using firewalls to limit access to the server and configuring perimeter devices to check for memory attacks. 

More details will be published here as we have them.

--
John Bambenek
bambenek at gmail /dot/ com