News

Four New Flaws Found in IIS

• By Scott Bekker
• May 28, 2003

The flaws affect IIS 4.0, which runs on Windows NT 4.0; IIS 5.0, which runs on Windows 2000; and IIS 5.1, which runs on Windows XP. IIS 6.0, which shipped with Windows Server 2003 last month and received a security overhaul under the Trustworthy Computing initiative, is not affected.

The most serious problem affects IIS 5.0 and 5.1 and is rated "important" by Microsoft.

"A denial of service vulnerability that results because IIS 5.0 and 5.1 do not correctly handle an error condition when an overly long WebDAV request is passed to them. As a result an attacker could cause IIS to fail – however both IIS 5.0 and 5.1 will by default restart immediately after this failure," Microsoft wrote in its bulletin about the most serious flaw.

The other three flaws are rated "moderate." Microsoft's threat scale ranges from "low" to "moderate" to "important" to "critical."

A cross-site scripting vulnerability affects IIS 4.0, 5.0 and 5.1. A buffer overrun involves IIS 5.0. A separate denial-of-service vulnerability affects IIS 4.0 and IIS 5.0.

The IIS security bulletin can be found at:
www.microsoft.com/technet/security/bulletin/MS03-018.asp

The new patch is dependent on a patch issued in a security bulletin last year (MS02-050). If the new patch is installed and MS02-050 is not in place, client-side certificates will be rejected.

The bulletin is one of two issued by Microsoft on Wednesday. The other bulletin deals with a moderate denial-of-service threat to Windows NT 4.0 and Windows 2000.

That bulletin is available here:
www.microsoft.com/technet/security/bulletin/MS03-019.asp.