IIS configuration error leads to increased threat, Microsoft says

Article

IIS configuration error leads to increased threat, Microsoft says

Microsoft said an Internet Information Services (IIS) parsing extension issue,which could lead to a vulnerable system, is not a flaw that can be patched, but an IIS

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

configuration error that can be avoided by following best practices.
Microsoft IIS best practices:
IIS 6.0 security best practices: Microsoft TechNet document outlines best practices for configuring the Web server.

Microsoft updates:

Dec. - Microsoft gives Internet Explorer a major security overhaul: The final regular Microsoft update of 2009 repairs five critical vulnerabilities in IE and blocks public exploit code, which surfaced in November.

The software giant issued an update on its blog last week, giving links outlining best practices for configuring the IIS Web server. A security expert warned last week about the discovery of a parsing extension vulnerability that could be exploited to pass malicious code and ultimately gain control of the Web server. The issue was described as an error in the way IIS 6 handles semicolons in URLs.

But Microsoft's Christopher Budd explained on the company's Security Response Center blog that the issue is a IIS configuration error that could lead to a vulnerable system. The out-of-the-box, default configuration will not enable an attacker to bypass content filtering software to upload malicious code on the Microsoft Web server.

"This is not the default configuration for IIS and is contrary to all of our published best practices," Budd wrote. "Quite simply, an IIS server configured in this manner is inherently vulnerable to attack."

Budd added that users of IIS with both "write" and "execute" privileges on the same directory should review best practices and make changes to mitigate similar threats to the Web server.