[taxcontrol]

Folks, this is VERY DANGEROUS.

The service is ON by default and can result in a total compromise of the server. Patch is available - fix it now or you WILL get burned.

The exploit is already in the wild.

[taxcontrol]

Not casting any stones. Just passing on a security alert as I'm in the security field. So, heads up.

[Airborne Longhorn]

Saw nothing about WinXP.

Thoughts, anyone?

[1stFreedom]

Thanks for the post. I applied the patch already.

I have to say, it's nice that the patches are easy to apply, but it's hell trying to build a server up from scratch. (Even with Windows Update it's a pain.)

I'm running SQL Server 2000, IIS 5, VS .NET, .NET matrix, etc., so there are numerous updates one has to perform in order to have a stable and secure system.

I really hope that Windows 2003 tackles these security problems IN THE FIRST RELEASE and not in patches.

[chilepepper]

Ah, Microsoft's contribution to the Iraq Effort:

A THREAT TO UNITED STATES NATIONAL SECURITY DURING WARTIME

Are there any jokers left who actually recommend IIS to their CIOS???? Please let me know so I can short the stock.

[Texas_Jarhead]

thanks for the alert

[clueless idiot]

No hoax, and incidentally it's flagged as "critical, patch immediately". Here's the email from NTBugtraq by way of the incidents.org mailing list:

From: Windows NTBugtraq Mailing List
On Behalf Of Russ
Sent: Monday, March 17, 2003 13:20
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Alert: Microsoft Security Bulletin - MS03-007

http://www.microsoft.com/technet/security/bulletin/MS03-007.asp

Unchecked buffer in Windows component could cause web server
compromise (815021)

Originally posted: March 17, 2003

Summary

Who should read this bulletin: Systems administrators running
Microsoft ® Windows ® 2000

Impact of vulnerability: Run code of attacker's choice

Maximum Severity Rating: Critical

Recommendation: Systems administrators should apply the patch
immediately

Affected Software:
- Microsoft Windows 2000

Technical description:

Microsoft Windows 2000 supports the World Wide Web
Distributed Authoring and Versioning (WebDAV) protocol.
WebDAV, defined in RFC 2518, is a set of extensions to the
Hyper Text Transfer Protocol (HTTP) that provide a standard
for editing and file management between computers on the
Internet. A security vulnerability is present in a Windows
component used by WebDAV, and results because the component
contains an unchecked buffer.

An attacker could exploit the vulnerability by sending a
specially formed HTTP request to a machine running Internet
Information Server (IIS).  The request could cause the server
to fail or to execute code of the attacker's choice. The code
would run in the security context of the IIS service (which,
by default, runs in the LocalSystem context).

Although Microsoft has supplied a patch for this
vulnerability and recommends customers install the patch
immediately, additional tools and preventive measures have
been provided that customers can use to block the
exploitation of this vulnerability while they are assessing
the impact and compatibility of the patch. These temporary
workarounds and tools are discussed in the "Workarounds"
section in the FAQ below.

Mitigating factors:
- URLScan, which is a part of the IIS Lockdown Tool will
block this attack in its default configurations
- The vulnerability can only be exploited remotely if an
attacker can establish a web session with an affected server

Vulnerability identifier: CAN-2003-0109

[Doctor Stochastic]

It was known how to avoid buffer overflow errors at least back as far as 1971 and probably earlier. Continuing to have such errors (as in Windows and Unix variants) is bordering on the criminally negligent.

[RippleFire]

bump

[Nick Danger]

/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7 801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u90 90%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=ping

[cashion]

The service is ON by default and can result in a total compromise of the server. Patch is available - fix it now or you WILL get burned.

Are you sure IIS is enabled by default on W2K? I may be wrong, but I'm pretty sure it isn't. Normally one would enable IIS by going into Add/Remove Programs, Add/Remove Windows Components, and then selecting IIS.

[buckster]

THIS IS VEY VEY SERIES!!!! THIS IS HUGH!