Microsoft: IIS 6.0 Has 'Inconsistencies,' but No Bug

• By Jabulani Leffall
• 01/05/10

Microsoft denied that its Internet Information Services (IIS) Web server software is subject to new-found security vulnerability.

The bug was first reported to Microsoft Dec. 23, but Microsoft closed the investigation last week claiming that the potential problem isn't a vulnerability. Microsoft spokesperson Christopher Budd said in a Dec. 29 blog that there are some "inconsistencies" with IIS version 6.0, but no "new" exploits.

Details of the so-called vulnerability first surfaced Christmas Day when security researcher Soroush Dalili posted findings on his personal blog. Dalili's assertion gained credence from third-party security company Secunia, which last updated its own findings Dec. 30.

Secunia explained that the IIS problem results from the Web server "incorrectly executing Active Server Page code in files with extensions separated by semicolons (e.g. 'file.asp;.jpg')." The security firm explained that this IIS bug "can be exploited to potentially upload and execute arbitrary ASP code via a third-party application using file extensions to restrict uploaded file types."

This discovery marked the third time in 2009 that IIS bugs or glitches have been identified. Microsoft's security researchers disagreed, saying that the exploit could only happen if the server was misconfigured to have both write and execute privileges, contrary to IIS 6.0 best practices for security. Budd suggested that Microsoft is considering changing IIS 6.0 to make its functionality more "in line with the other versions" of the Web server software.

"What we have seen is that there is an inconsistency in IIS 6 only in how it handles semicolons in URLs," Budd said in his post. "It's this inconsistency that the claims have focused on, saying this enables an attacker to bypass content filtering software to upload and execute code on an IIS server."

Dalili and Secunia explained the issue differently, saying that the real problem is that IIS can execute any extension as ASP code.

"By using this vulnerability, an attacker can bypass this protection and upload a dangerous executable file on the server," Dalili said in his post.

Budd suggested users should review Microsoft's best practices for IIS 6.0 security, particularly if the Web server is configured with both write and execute privileges on the same directory.