Security

A vulnerability in Microsoft's software for housing Web sites is now being used for "limited attacks" on the servers it's running on, the company said Friday.

Microsoft disclosed the Internet Information Services (IIS) vulnerability on Monday and said Friday it's still working on a security update to fix the problem. In the meantime, the advisory has instructions for a workaround, including disabling various elements of the vulnerable FTP (File Transfer Protocol) service to upload and download files.

According to the advisory, the vulnerability could let somebody run arbitrary code on a server using FTP on IIS 5.0 and conduct a denial-of-service attack using FTP on IIS 5.1, 6.0, and 7.0. The present version 7.5 isn't affected, though, and FTP 7.5 can be downloaded and installed on IIS 7.0 to protect it.

"Customers should be aware that the Download Center has FTP 7.5 available for Windows Vista and Windows Server 2008. FTP 7.5 is not vulnerable to any of these exploits," said Alan Wallace, senior communications manager for Microsoft's security response communications team, in a statement.

Initially, the company said it was investigating a vulnerability only with versions 5 and 6 of IIS.

Microsoft on Monday said it is looking into a report of a flaw in some versions of its Internet Information Services product that could allow an attacker to gain control of a system.

In a statement, a Microsoft representative said the company "is investigating new public claims of a possible vulnerability in IIS 5 and IIS 6 File Transfer Protocol (FTP)."

Microsoft said it is not aware of any attacks using the vulnerability. "We will take steps to determine how customers can protect themselves, should we confirm the vulnerability."

According to IDG News Service, code for exploiting the unpatched flaw was posted to the Milw0rm Web site. IDG said the exploit appears to affect primarily older versions of IIS--and only when the FTP function is enabled.

Once it is done with its investigation, Microsoft said, it will decide how to address the matter, which could include a security update as part of its monthly Patch Tuesday or an out-of-cycle update.

In a posting on Monday, the U.S. Computer Emergency Readiness Team (US-CERT) suggested IT administrators "disable anonymous write access to the FTP server to help mitigate the vulnerability" but added that "a proper impact analysis should be performed prior to taking defensive measures."

Updated at 2:20 p.m. PDT with Adobe update released; at 12:25 p.m. PDT with Microsoft saying this is a record number of vulnerabilities addressed in Patch Tuesday; and at 11:45 a.m. PDT with comment.

Microsoft has released 10 security updates fixing a record number of Patch Tuesday holes, including one for a critical hole in Internet Explorer 8 that was exploited as part of a hacking contest at CanSecWest in March.

The bulletin addresses 31 vulnerabilities. "It's the most since Microsoft started releasing updates on a regular schedule of the second Tuesday of every month in October 2003," a Microsoft spokesman said.

The June security Patch Tuesday bulletin resolves eight vulnerabilities in IE, the more severe of which could allow remote code execution if a user views a specially crafted Web page. The IE8 vulnerability does not affect Windows 7 RC (build 7100), but does affect Windows 7 beta.

The updates also plug two critical holes in implementations of Active Directory on Windows 2000 Server and Windows Server 2003, and Active Directory Application Mode installed on Windows XP Professional and Server 2003, the worse of which could allow an attacker to take control of a system remotely.

The security update fixes three critical vulnerabilities in Windows Print Spooler that could allow remote code execution if an affected server received a specially crafted RPC (remote procedure call) request.

Several vulnerabilities in Office Word and Excel are addressed in the update that could allow an attacker to remotely run code or take control of the machine using a specially crafted Word or Excel file. The update fixes the PowerPoint vulnerability Microsoft warned in April was being exploited in limited, targeted attacks that was fixed in the Windows version last month.

The update includes a patch for an important hole in its IIS Web server product that Microsoft reported in May.

"We didn't see any in-the-wild exploitations of the (IIS WebDav) vulnerability but typically when Microsoft releases those alerts they're doing it because a customer" has alerted them to an exploit, said Steve Manzuik, senior manager of security research at Juniper Networks.

Also fixed is a critical vulnerability in Microsoft Works Converters, important vulnerabilities in RPC and Windows Kernel. And Microsoft fixed a moderate vulnerability in Windows Search that could allow information disclosure if a user performs a search that returns a specially crafted file as the first result, or if the user previews a malicious file from the search results. By default, the Windows Search component is not preinstalled on Windows XP and Server 2003.

Products affected by the updates include Windows 2000, XP, XP Professional edition, Vista, Server 2003, Server 2008; Office 2000, 2003, 2007, and XP; and Microsoft Office 2004 and 2008 for the Mac.

Other affected software includes Office Excel Viewer; Office Word Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats; Works 8.5 and 9.0; and Office SharePoint Server.

The updates did not include a fix for a vulnerability in Microsoft's DirectX streaming media technology in Windows disclosed late last month that could allow someone to take complete control of a computer using a maliciously crafted QuickTime file.

"They probably didn't have time to QA (quality assurance test) it adequately," said Wolfgang Kandek, chief technology officer at Qualys. "It doesn't surprise me because look at how many vulnerabilities they had in this release. It must have been an enormous workload for these teams to fix all of these."

Adobe also issued security updates for Adobe Reader and Acrobat versions 7.x, 8.x, and 9.x for Windows and Macintosh on Tuesday in its first quarterly security update for its popular software for creating and reading PDF files.

The updates, available from Adobe's site, resolve critical vulnerabilities in Adobe Reader 9.1.1 and Acrobat 9.1.1 and earlier versions that could cause the application to crash and could potentially allow an attacker to take control of the system.

Updated 6 p.m. PDT with Microsoft comment.

It apparently didn't take long for hackers to try to take advantage of a zero-day hole in Microsoft Internet Information Services (IIS).

Ball State University in Muncie, Ind., told The Register that servers running the program were breached on Monday, the same day Microsoft warned the public about the vulnerability.

Students accessing their iWeb pages on Monday saw messages saying the system had been hacked, The Register reported on Wednesday. There is no evidence data was stolen or malicious files uploaded, however the iWeb accounts were expected to be offline until Thursday or Friday, according to Patty Lucas, a senior help desk support administrator for the university's computing services department.

Microsoft, meanwhile, said it has investigated a public report of a targeted attack on the IIS hole, but did not specify whether it was the Ball State University breach that was looked into.

The investigation "revealed that the vulnerability was not exploited to accomplish this attack," a Microsoft spokeswoman wrote in an e-mail late on Wednesday. "Microsoft is still not aware of attacks that are trying to use this vulnerability or of customer impact at this time."

The computing services department referred a call from CNET News on Wednesday afternoon to the communications department, which was already closed for the day.

The security vulnerability could allow an attacker to gain access to a location that typically requires authentication by using a specially crafted anonymous HTTP request, according to the Microsoft security bulletin. The problem exists in the way that the WebDAV extension for IIS handles HTTP requests.

According to a posting to the Full Disclosure security e-mail list on Friday, the IIS security vulnerability was discovered on May 12 by Nikolaos Rangos.