News

IIS Cumulative Patch Released

Microsoft Corp. issued a cumulative patch this week for its Internet Information Services Web server that fixes four critical new vulnerabilities and six other newly discovered bugs.

It is the largest collections of new bug fixes for IIS outside of a service pack in the last two years. The last cumulative patch for IIS was in August and fixed five flaws. A May 2001 cumulative patch rollup fixed three problems.

As a cumulative patch, the fix also includes all previously released fixes for the standalone IIS 4.0; IIS 5.0, which ships in Windows 2000; and IIS 5.1, which ships in Windows XP Professional Edition. Microsoft says it didn't include Windows .NET Server's IIS 6.0 in the general patch because it is a beta product and is not intended for production use. Microsoft was sending fixes directly to the limited number of customers officially running IIS 6.0 in production environments.

The security bulletin and patch are available at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-018.asp.

All four of the critical flaws involve buffer overflows. The other problems involve cross-site scripting, a denial of service via an FTP status request and an access violation in URL error handling.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Google To Acquire Cloud Startup Wiz for $32 Billion

    Google has announced a pending agreement to acquire Wiz Inc., a cloud security platform, in an all-cash deal worth $32 billion.

  • FTC Expands Microsoft Antitrust Investigation Under Trump Administration

    The Federal Trade Commission (FTC) is pressing ahead with a broad investigation into Microsoft's business practices, an inquiry that began in the final weeks of the Biden administration.

  • Microsoft to Shut Down Skype Services

    Microsoft will discontinue its Skype telecommunications and video calling services on May 5, 2025, marking the end of the platform's decades-long run.

Most   Popular