* 16:04 PM CST 12/22/10 by jcb * A 0-day exploit has been published at exploit-db (see US-Cert advisory) that takes advantage of a memory corruption vulnerability in IIS 7.5's FTP service. This bug will work pre-authentication. From the looks of it, it is a pure remote exploit that's chief use would be denial of service. As with any memory corruption bugs, it is theoretically possible to use this to gain access to the server with the permissions of the user that is running IIS. I think that would be difficult in this case, but time will tell. It is, nevertheless, a serious bug that at present has no patch. (As of this writing, Microsoft hasn't confirmed it is an issue). Some defenses would be limiting FTP services that are internet-facing (especially if IIS), using firewalls to limit access to the server and configuring perimeter devices to check for memory attacks. More details will be published here as we have them. -- |
John 262 Posts ISC Handler Dec 22nd 2010 |
Thread locked Subscribe |
Dec 22nd 2010 1 decade ago |
Confirmed by MS: http://blogs.technet.com/b/srd/archive/2010/12/22/assessing-an-iis-ftp-7-5-unauthenticated-denial-of-service-vulnerability.aspx
|
Anonymous |
Quote |
Dec 23rd 2010 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!