[ISN] IIS 6 attack could let hackers snoop on servers

[InfoSec News]

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9133219

By Robert McMillan
May 18, 2009 
IDG News Service

Security vendors are warning users of Microsoft's Internet Information 
Services 6 Web-server software that a new online attack could put their 
data at risk.

The flaw was made public Thursday, when security researcher Nikolaos 
Rangos posted details of the vulnerability to the Full Disclosure 
security mailing list. By sending a specially crafted HTTP request to 
the server he was able to view and upload files on the machine. The 
attack takes advantage of a bug in the way that Microsoft's software 
processes Unicode tokens, he said.

The vulnerability is being used in online attacks, the U.S. Computer 
Emergency Response Team said Monday.

In a statement, Microsoft said it hadn't heard of any such attacks, but 
that it was investigating Rangos' claims. "We are working on a security 
advisory to provide customers with guidance," the company said Monday.

The bug affects IIS 6 users who have enabled the WebDAV (Web-based 
Distributed Authoring and Versioning) protocols, used to share documents 
via the Web.

[...]