Microsoft: IIS 6.0 Has 'Inconsistencies,' but No Bug

Microsoft denied that its Internet Information Services (IIS) Web server software is subject to new-found security vulnerability.

The bug was first reported to Microsoft on Dec. 23, but Microsoft closed the investigation last week claiming that the potential problem isn't a vulnerability. Microsoft spokesperson Christopher Budd said in a Dec. 29 blog that there are some "inconsistencies" with IIS version 6.0, but no "new" exploits.

Details of the so-called vulnerability first surfaced on Christmas Day when security researcher Soroush Dalili posted findings on his personal blog. Dalili's assertion gained credence from third-party security company Secunia, which last updated its own findings on December 30.

Secunia explained that the IIS problem results from the Web server "incorrectly executing Active Server Page code in files with extensions separated by semicolons (e.g. 'file.asp;.jpg')." The security firm explained that this IIS bug "can be exploited to potentially upload and execute arbitrary ASP code via a third-party application using file extensions to restrict uploaded file types."

This discovery marked the third time in 2009 that IIS bugs or glitches have been identified. Microsoft's security researchers disagreed, saying that the exploit could only happen if the server was misconfigured to have both write and execute privileges, contrary to IIS 6.0 best practices for security. Budd suggested that Microsoft is considering changing IIS 6.0 to make its functionality more "in line with the other versions" of the Web server software.

"What we have seen is that there is an inconsistency in IIS 6 only in how it handles semicolons in URLs," Budd said in his post. "It's this inconsistency that the claims have focused on, saying this enables an attacker to bypass content filtering software to upload and execute code on an IIS server."

Dalili and Secunia explained the issue differently, saying that the real problem is that IIS can execute any extension as ASP code.

"By using this vulnerability, an attacker can bypass this protection and upload a dangerous executable file on the server," Dalili said in his post.

Budd suggested users should review Microsoft's best practices for IIS 6.0 security, particularly if the Web server is configured with both write and execute privileges on the same directory.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Silver Pins

    Microsoft Teams Sprawl: What It Is and How Partners Can Fix It

    Microsoft Teams is having its boom period and the remote-work revolution is driving it. But for many organizations, that hasn't been without its downsides.

  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • Privacy Management for Microsoft 365 Hits 'General Availability'

    Microsoft's Privacy Management for Microsoft 365 hit the "general availability" milestone on Tuesday, according to the company.

  • Notebook

    Sikich Acquires Gold Microsoft Dynamics Partner PA Group USA

    There's some consolidation happening in the Microsoft Dynamics space this week, with Sikich LLP announcing its plan to acquire Dynamics specialist PA Group USA.