Microsoft tells hackers how to take apart its IIS

[W1nTry]

Errr...

As if they needed a hand

By Nick Farrell: Wednesday 06 June 2007, 10:37
MICROSOFT IS showing all comers how to hack into its Internet Information Server and is not giving any hints how to work around the problem.

The Vole says an exploit, which was discovered on December 15, 2006, and made public at the end of May, is actually a feature.

Apparently versions 5.x allow bypass of basic authentication by using the "hit highlight" feature. The hit-highlighting feature can be used by an unauthorised user to nick documents.

The Internet Storm Centre says that hackers have not used this exploit to take over systems to date, that could well change. Especially now we've told them about it.

The Vole has written up the problem in its Knowledge Base article 328832. Apparently, hit-highlighting with Webhits.dll only relies on the Microsoft Windows NT ACL (Access Control List) configuration on 5.x versions.

Security experts are a bit stunned at the Volish attitude. Rather than supply a patch or workaround, Microsoft published six steps to reproduce the exploit. In otherwords Vole is telling the world how to exploit products being used by their customers.

The official Volish line is that all users should upgrade to IIS (Internet Information Services) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security, it says here.

[Saxito Pau]

This is an interesting ploy.

M$: "IIS5 is bad and we know it. IIS6 is better (just as bad and you don't know it). Don't want to upgrade to IIS6? Well we're not patching it, you idiot! We'll force you to upgrade by telling all the hackers how to breach IIS5.  *link to instructions*  Don't say you weren't warned!!"

[SPK]

The Vole says an exploit, which was discovered on December 15, 2006, and made public at the end of May, is actually a feature.

Damn, they really ARE becoming Ubersoft....

*waits for the Dark Lord of Ubersoft (Mr. Hoppy) to arise with his flaming "BOSS" letters floating around him...*