Replies

Et tu, ELS?

My heart, it breaks!

It doesn't take much to lock down IIS.

Security Operations Guide for Windows 2000 Server

Of course, UNIX systems are also vulnerable as Bush2000 has pointed out numerous times but that doesn't seem to get the press about Microsoft.

Companies that hire incompetent web managers get hacked no matter what.

Companies that hire incompetent web managers get hacked no matter what.

Yes, that is the essential truth.

I had been using IIS on WinNT at work for development purposes, which to my knowledge, no hackers were trying to get into. A version of the Nimda virus found the instance of IIS on my computer and proceeded to modify all sorts of files on my computer. Real nice. Granted the network ops guys were asleep on the job, but this virus doesn't make its home in Apache which I promptly switched to.

Of course, UNIX systems are also vulnerable as Bush2000 has pointed out numerous times but that doesn't seem to get the press about Microsoft.

From SecurityFocus, a list of vulns by product for the last 4 years:

Apache 2.0

2002-06-17:

Apache Chunked-Encoding Memory Corruption Vulnerability

One vuln.

One vuln in 4 years

.

Now, Microsoft IIS 5.0:

	2002-05-27:	Microsoft IIS 5.0 Denial Of Service Vulnerability
	2002-05-27:	Microsoft IIS HTR Chunked Encoding Transfer Heap Overflow Vulnerability
	2002-04-18:	Microsoft IIS CodeBrws.ASP File Extension Check Out By One Vulnerability
	2002-04-16:	Microsoft IIS CodeBrws.ASP Source Code Disclosure Vulnerability
	2002-04-10:	Microsoft IIS Help File Search Cross Site Scripting Vulnerability
	2002-04-10:	Microsoft IIS Chunked Encoding Transfer Heap Overflow Vulnerability
	2002-04-10:	Microsoft IIS HTTP Error Page Cross Site Scripting Vulnerability
	2002-04-10:	Microsoft IIS HTTP Redirect Cross Site Scripting Vulnerability
	2002-04-10:	Microsoft IIS Chunked Encoding Heap Overflow Variant Vulnerability
	2002-04-10:	Microsoft IIS HTR ISAPI Extension Buffer Overflow Vulnerability
	2002-04-10:	Microsoft IIS HTTP Header Field Delimiter Buffer Overflow Vulnerability
	2002-04-10:	Microsoft IIS ASP Server-Side Include Buffer Overflow Vulnerability
	2002-04-10:	Microsoft IIS ISAPI Filter Access Violation Denial of Service Vulnerability
	2002-04-10:	Microsoft IIS FTP Connection Status Request Denial of Service Vulnerability
	2002-03-05:	Microsoft IIS Authentication Method Disclosure Vulnerability
	2002-02-19:	Multiple Vendor HTTP CONNECT TCP Tunnel Vulnerability
	2002-01-31:	Microsoft MSDTC Service Denial of Service Vulnerability
	2002-01-16:	Multiple Vendor Unprivileged User Permissions Log File Modification Vulnerability
	2001-12-11:	Microsoft IIS False Content-Length Field DoS Vulnerability
	2001-08-15:	Microsoft IIS SSI Buffer Overrun Privelege Elevation Vulnerability
	2001-08-15:	Microsoft IIS 5.0 In-Process Table Privelege Elevation Vulnerability
	2001-08-15:	Microsoft IIS WebDAV Invalid Request Denial of Service Vulnerability
	2001-08-15:	Microsoft IIS MIME Header Denial of Service Vulnerability
	2001-08-08:	MS IIS Internal IP Address/Internal Network Name Disclosure Vulnerability
	2001-07-04:	Microsoft IIS Device File Local DoS Vulnerability
	2001-07-04:	Microsoft IIS Device File Remote DoS Vulnerability
	2001-05-17:	IIS WebDav Lock Method Memory Leak DoS Vulnerability
	2001-05-15:	MS IIS/PWS Escaped Characters Decoding Command Execution Vulnerability
	2001-05-14:	Microsoft IIS Various Domain User Account Access Vulnerability
	2001-05-06:	Microsoft IIS WebDAV 'Propfind' Server Restart Vulnerability
	2001-05-01:	Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
	2001-03-16:	Microsoft IIS WebDAV 'Search' Denial of Service Vulnerability
	2001-03-08:	Microsoft IIS WebDAV Denial of Service Vulnerability
	2001-03-01:	Microsoft IIS Multiple Invalid URL Request DoS Vulnerability
	2001-03-01:	Microsoft Exchange 2000 / IIS 5.0 Multiple Invalid URL Request DoS Vulnerability
	2001-01-29:	Microsoft IIS File Fragment Disclosure Vulnerability
	2000-12-22:	Microsoft IIS Front Page Server Extension DoS Vulnerability
	2000-11-06:	Microsoft IIS Executable File Parsing Vulnerability
	2000-10-23:	Microsoft IIS 4.0/5.0 Session ID Cookie Disclosure Vulnerability
	2000-10-17:	Microsoft IIS and PWS Extended Unicode Directory Traversal Vulnerability
	2000-10-04:	Microsoft IIS 5.0 Indexed Directory Disclosure Vulnerability
	2000-08-21:	Microsoft FrontPage/IIS Cross Site Scripting shtml.dll Vulnerability
	2000-08-21:	Microsoft IIS Cross Site Scripting .shtml Vulnerability
	2000-08-14:	Microsoft IIS 5.0 "Translate: f" Source Disclosure Vulnerability
	2000-08-10:	Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability
	2000-07-17:	Microsoft IIS 4.0/5.0 Source Fragment Disclosure Vulnerability
	2000-07-14:	Microsoft IIS 3.0 .htr Missing Variable Denial of Service Vulnerability
	2000-07-13:	Microsoft IIS Internal IP Address Disclosure Vulnerability
	2000-05-14:	Microsoft IIS FTP Denial of Service Vulnerability
	2000-05-11:	Microsoft IIS 4.0/5.0 Malformed File Extension DoS Vulnerability
	2000-05-11:	Microsoft IIS 4.0/5.0 Malformed Filename Request Vulnerability
	2000-05-10:	Microsoft IIS 4.0/5.0 Malformed .htr Request Vulnerability
	2000-05-06:	Microsoft Frontpage Server Extensions Path Disclosure Vulnerability
	2000-04-12:	Microsoft IIS 4.0/5.0 Escaped Characters Vulnerability
	2000-03-30:	Microsoft IIS UNC Mapped Virtual Host Vulnerability
	2000-03-08:	Microsoft IIS UNC Path Disclosure Vulnerability
	2000-02-09:	NT IIS ASP VBScript Runtime Error Viewable Source Vulnerability
	1999-01-26:	NT IIS IISAPI Extension Enumerate Root Web Server Directory Vulnerability

It is, in my opinion, professional incompetence to use MS IIS for any mission-critical web work.