Microsoft IIS 5/6 FTP 0Day released - SANS Internet Storm Center

Participate: Learn more about our honeypot network
https://isc.sans.edu/tools/honeypot/

Handler on Duty: Didier Stevens

Threat Level: green

Microsoft IIS 5/6 FTP 0Day released
We are aware of a new 0-day exploit that was posted on Milw0rm today. According the exploit, it was suppose to work on both IIS 5.0 and 6.0, on the FTP module. Also according it, it affects IIS 6.0 with stack cookie protection. The latest on this is that HDMoore is porting it to the MetaSploit framework. We will update this diary with more info as we get it. UPDATE3: SourceFire Blog about it UPDATE2: US-CERT released an advisory on it: https://www.kb.cert.org/vuls/id/276653 UPDATE: Emerging Threats have released a signature for the milw0rm IIS-FTP exploit. It's available in the signature tarballs and a history is available in CVS: http://www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_IISFTP Wiki: http://doc.emergingthreats.net/bin/view/Main/2009828 --------------------------------------------------------------- Handler on Duty: Pedro Bueno (pbueno /%%/ isc. sans. org) Twitter: http://twitter.com/besecure	Pedro 155 Posts ISC Handler Aug 31st 2009
Thread locked Subscribe	Aug 31st 2009 1 decade ago
it requires an account or anon to be enabled on the target, which somewhat limits the scope of this otherwise damaging bug.	Anonymous
Quote	Sep 1st 2009 1 decade ago
MS released Security Advisory 975191 on the issue: http://www.microsoft.com/technet/security/advisory/975191.mspx See also http://blogs.technet.com/msrc/archive/2009/09/01/microsoft-security-advisory-975191-released.aspx and http://blogs.technet.com/srd/archive/2009/09/01/new-vulnerability-in-iis5-and-iis6.aspx for additional informations from MS.	Anonymous
Quote	Sep 2nd 2009 1 decade ago