A hacker has uncovered a vulnerability in Microsoft’s Internet Information Services (ISS) product, which could allow attackers to gain control of vulnerable machines.
Proof-of-concept code for a zero-day vulnerability was posted to the Milw0rm website. Reportedly, the flaw affects the FTP module of the IIS 5.0 and 6.0. As the flaw lies in the file transfer protocol used by the IIS, the system would be vulnerable only when the FTP is enabled by the user.
The US-CERT said in a statement: “US-CERT is aware of a public report of a vulnerability affecting the Microsoft Internet Information Services (IIS) FTP service. This vulnerability may allow a remote attacker to execute arbitrary code.
The Cybersecurity agency is advising the administrators to disable anonymous write access to the FTP server, in order to mitigate the vulnerability. However, the agency said that proper impact analysis should be performed prior to taking defensive measures.
Microsoft is said to be investigating the claims of a reported vulnerability in IIS 5.0 and 6.0 file transfer protocol (FTP). The company reportedly said that it would take steps to protect its customers if the vulnerability is confirmed.
InformationWeek reported Microsoft spokesperson as saying: “We are currently unaware of any attacks trying to use the claimed vulnerability or of customer impact.”
