Comments on: Report: Attackers exploit IIS hole to breach university server

Indiana university hit by attackers exploiting a hole in Microsoft Internet Information Services software.

[monkeyfun14]

Funny thing is if nothing was ever said as I stated before this probably would of never happened isn't the media just lovely?

[Vegaman_Dan]

It's a problem that all OEM's face when it comes to this. Do you publically disclose that there is a vulnerability when there is a chance that if you do, that someone will exploit it, or keep it hidden from public knowledge and patch it without telling anyone or admitting to a problem? One is more honest but vulnerable, the other is more sneaky and dishonest, but probably safer. It's an ethical question that has no right answer.

[Random_Walk]

No, the reality is that someone would have found it anyway, exploited the crap out of it, and then after much damage had been done would word get out... just like the old days.

After all, someone had to discover it, then report it to Microsoft (or submit a fix request if it was internal), no?

[Jimmu411]

Doesn't the article state that the zero-day exploit was not used for the break in? It looks like the article was patched with new info, but the headline wasn't?

[ti99_forever]

It it just sickening that years after Microsoft committed itself to better security (and better coding practices) that there are still so many issues, and many of them still buffer overflow problems.

Thanks K&R!

[monkeyfun14]

No OS is perfect Linux and OSX have their share of vulnerabilities

[KeithFromDG]

The reported fails to mention that WebDAV has to manually be enabled by the person that deployed IIS. WebDAV is disabled by default. In addition WebDAV is NOT required for most of hosted sites on IIS or whatever. For more details on WebDAV: http://www.webdav.org/other/faq.html#Q2
Also, keep in mind that this is first security issues IIS has had in about 2 or more years. I dont think that constitues a like of effort on the part of Microsoft.

[dmancini1979]

Nothing worse than a loose IIS Hole

[rmva]

Also that this applies to IIS 6, but not IIS 7.

I have read about this problem for awhile. Then I was attacked. My computer would not do anything. I counldn't get into IE. I had to clean drive c and reinstall vista ultimate. Is there something I can do to stop this. This is the second time it has happened. I am protected with anti virus, but it seems the hackers have found a way around that, which is of no surprise to me. I don't open emails I don't recognize. What can I do. You could email me at [e-mail]. I did see something that Microsoft put out, but I am not sure how to follow the instructions.