Forgot your password?
typodupeerror
Security

+ - Microsoft Downplays Serious IIS Bug Threat

Submitted by
snydeq
snydeq writes "Microsoft confirmed that its IIS Web server software contains a vulnerability that could let attackers steal data, but downplayed the threat. The flaw, which involves how Microsoft's software processes Unicode tokens, has been found to give attackers a way to view protected files on IIS Web servers without authorization. The vulnerability, exposed by Nikolaos Rangos, could be used to upload files as well. Affecting IIS 6 users who have enabled WebDAV for sharing documents via the Web, the flaw is currently being exploited in online attacks, according to CERT, and is reminiscent of the well-known IIS unicode path traversal issue of 2001, one of the worst Windows vulnerabilities of the past decade."
This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

Microsoft Downplays Serious IIS Bug Threat

Comments Filter:

IF I HAD A MINE SHAFT, I don't think I would just abandon it. There's got to be a better way. -- Jack Handley, The New Mexican, 1988.

Working...