Microsoft downplays IIS security vulnerability talk
Microsoft is downplaying talk of a zero-day bug in Internet Information Services (IIS).
Last week, reports began to circulate of a security vulnerability in IIS. The issue was due to the way IIS 6 handles semicolons in URLs. However Microsoft contends that because IIS must be in an unsecure configuration, the handling of semicolons is essentially besides the point.
“The key in this is...for the scenario to work, the IIS server must already be configured to allow both “write” and “execute” privileges on the same directory,” blogged Christopher Budd, communications lead for Microsoft Security Response Center. “This is not the default configuration for IIS and is contrary to all of our published best practices. Quite simply, an IIS server configured in this manner is inherently vulnerable to attack."
