MS Gives Exploit Code for IIS 5.0 Bug

[HardOCP News]

Microsoft has published exploit code for an Internet Information Server exploit but no did not release a workaround or patch, saying that the flaw is due to a feature.

The exploit, which was discovered on Dec. 15, 2006, and made public at the end of May, works against IIS 5.x. By design, versions 5.x allow bypass of basic authentication by using the "hit highlight" feature. The hit-highlighting feature can be used by an unauthorized user to grab documents to which he or she has no privileges.

 

[Binkt]

I thought I was reading BBspot!

did they really just use the "its not a bug, its a feature" line?!

well, with the code release, at least it will be well documented (and implemented). Is there someone here who runs IIS and can explain a way for this situation to be resolved in a non-destructive manner? Can the feature simply be disabled?

IS there someone who runs IIS?

 

[defuseme2k]

plenty of people use it. Typically I'd say its more internal use for larger companies. There are a lot of applications that have web components that rely on it

 

[chrisf6969]

Similarly, at a press conference this morning Bill Gates told reporters any & all exploits found were there on purpose as features and they would tell us about them later, as people found them. Then as Bill left the stage, he tripped fell on his face, got up and said "I meant to do that"!!