Unpatched flaw could take down Microsoft's IIS server
A hacker has posted code that could be used to take over a system running Microsoft IIS (Internet Information Services) server.
The software, which was posted to the Milw0rm Web site on Monday, could be a big problem for some webmasters, however the attack appears to work only on older versions of Microsoft's products. It was not immediately clear how many versions of Microsoft's products are vulnerable to the attack, and Microsoft did not immediately respond to requests for more information on the issue.
The flaw lies in the File Transfer Protocol (FTP) software used by IIS to move large files around the Internet, so the victim would have to have FTP enabled in order to be vulnerable to the attack. According to the Milw0rm post, an attacker could use this code to install unauthorized software on the server.
