A flaw in Microsoft`s Web server, IIS 5, allows hackers full access to millions of Web servers. So far, Microsoft is aware of three international hacks but no local attacks through this method.
The security vulnerability, discovered by eEye Digital Security, could be responsible for the spate of hacks over the Internet since Thursday. Vodacom, which runs IIS 5, was purportedly hacked on Thursday. ITWeb was hacked on Friday morning, through the same exploit, by a group called "Prime Suspectz".
There are about five million sites running IIS in the world, and Microsoft estimates that at least one million of those have upgraded to version 5.
The hack uses a buffer overflow technique on the .printer ISAPI request. In the Jill implementation, the code in the buffer overflow returns a system-level command prompt. "Now normally the Web server would stop responding once you have 'buffer overflowed` it," states eEye`s security alert. "However, Windows 2000 will automatically restart the Web server if it notices that the Web server has crashed. While the feature is nice to help create a longer period of 'uptime`, it is actually a feature that makes it easier for remote attacks to execute code against Windows 2000 IIS 5.0 Web servers."
"Worldwide there have been three issues that we are aware of, and none locally," comments Desmond Nair, product marketing manager for Microsoft enterprise server products. "This issue has a very high priority for Microsoft. Technical account managers have sent out security bulletins to our corporate customers."
Nair suggests that IIS 5 users follow the guidelines in the IIS 5 Microsoft Security Checklist, which has advised the disabling the .printer ISAPI application for some time.
Tools for executing the hack have already been created. The first is a proof-of-concept application designed by eEye that simply leaves a message on the hacked machine to prove that it was successful, while the second - an application slugged Jill - returns a command prompt to the user, giving hackers full system access to the server.
A patch for the vulnerability is available from Microsoft here. On its site, Microsoft states: "Clearly, this is a very serious vulnerability, and Microsoft strongly recommends that all IIS 5.0 administrators install the patch immediately."
Vodacom was not available for comment at the time of publication.
Share
