Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-Microsoft
[Top] [All Lists]

Re: IIS 5

Subject: Re: IIS 5
Date: Tue, 27 Feb 2007 17:09:42 +0000
Mike,

Mike Coppins wrote:
Have there really been no vulnerabilities in IIS5 since Win2k SP4 Rollup 1? Seems a bit unreal to me...

Where're you getting your data from? As far as I can see there have been two hotfixes released that affect IIS on Windows 2000 since then:


KB 917537 (Microsoft Internet Information Services ASP Code Buffer Overflow)

KB 906910 (Microsoft IIS "500-100.asp" Source Code Disclosure)

Neither of those appear on the list of hotfixes in Rollup 1 (http://support.microsoft.com/kb/900345/) - which makes sense, since the release dates listed for them on secunia (http://secunia.com/product/39/?task=advisories) are after April 2005 in both cases.

For comparison.. two hotfixes in over 20 months stands up against 4 released for Apache 1.3.x in the same timeframe.

 - James.

--
  James (njan) Eaton-Lee | UIN: 10807960 | http://www.jeremiad.org

  "The universe is run by the complex interweaving of three
  elements: Energy, matter, and enlightened self-interest." - G'Kar

 https://www.bsrf.org.uk | ca: https://www.cacert.org/index.php?id=3
--

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

<Prev in Thread] Current Thread [Next in Thread>
  • IIS 5, Mike Coppins
    • Re: IIS 5, James (njan) Eaton-Lee <=