Microsoft fixes major web server flaw

Microsoft has fixed a major vulnerability in its Internet Information Server (IIS) that could allow a malicious user to sabotage a victim's server via a web browser.

In a security alert issued late last night Microsoft warned: "This is a serious vulnerability, and Microsoft recommends that all customers using its IIS 4.0 or 5.0 take action immediately to protect their systems." Microsoft took just two hours to fix the flaw, first reported on the Bugtraq security mailing list.

The problem will be a concern for thousands of website operators. According to Netcraft, which conducts monthly surveys into web server use, 19 per cent of the 4.1 million companies it questioned use IIS.

Microsoft said the flaw would enable a malicious user to execute code of their choice on a vulnerable web server. The type of code that could be run would be limited by the specific server configuration, but in most cases it would be possible for the malicious user to execute any code that an authenticated user could run.

"This would give him the ability to install and run code, add, change or delete files or web pages, or take other actions," said Microsoft.

According to the software giant, attackers could execute virtually any operating system command, and this would enable them to cause a wide range of damage. They could, for example, create new files on the server, delete ones that are already there, or reformat the entire hard drive.

"This isn't the worst he [a malicious user] could do," said Microsoft. "He wouldn't be limited to misusing code that already exists on the server. Access to the operating system commands would give him the vulnerability to upload code of his choice to the machine and execute it."

Paul Rogers, network security analyst at security consultancy MIS, said he is impressed with the speed in which Microsoft has responded to the problem. "They have realised the serious nature of the issue and come up with a fix. The only issue now is communicating this to their customers," he said.

"This highlights the many serious security vulnerabilities of IIS."

For more information, visit: http://www.microsoft.com/technet/security/bulletin/fq00-078.asp