Microsoft admits flaw in Windows 2000 server software
Microsoft Corp. on Tuesday acknowledged that an "extremely serious"
flaw in an obscure extension included in Windows 2000 could allow a hacker to
gain complete control of any system running both Windows 2000 and the company's
Internet Information Services (IIS) 5.0 server.
The bug, which affects Windows 2000 Server, Windows 2000 Advanced Server, and
Windows 2000 Datacenter, is due to an error in an extension that enables the
Internet Printing Protocol, a feature installed by Windows 2000 that allows
for the submission and controlling of print jobs over HTTP. Because of an error in the coding of the ISAPI (Internet Services Application Programming Interface) extension that implements Internet Printing,
a hacker can send a certain kind of data to any server running Windows 2000
and IIS 5.0, cause a buffer overflow, and take full control of the system through
ISAPI, the company said.
Microsoft has made available on its Web site a patch that fixes the problem.
It is "imperative" that anyone running IIS 5.0 apply the patch, said
Scott Culp, program manager of Microsoft's security response center. The flaw
is extremely serious, he said, because once exploited, any program can be run
as part of the operating system and take control of the operating system. "There
is literally nothing a program could not do," he said.
The hole was first reported to Microsoft 10 days ago by security-product vendor
eEye Digital Security. Microsoft has worked with eEye to verify and repair the
problem, Culp said, adding that eEye "handled this exactly right."
Information about the vulnerability and the patch have been posted on Microsoft's
Web site and information has been distributed to hundreds of thousands of Microsoft
users, partners and customers, Culp said.
Though the flaw is serious, it will only affect those who have explicitly enabled
Internet Printing, Culp said. In setting up IIS 5.0, users are told to disable
any unneeded components, were given automated options to doing so and were also
presented with an option to lock-down any components not explicitly enabled,
Culp said. Anyone who has followed these procedures and not enabled the Internet
printing extension should be fine, he said.
The bug reported Tuesday is only the latest in a series of high-profile flaws
in Microsoft Internet products. In mid-April, the company's ISA Server was found
to be vulnerable to a denial of service attack and in late March, holes were
found in the company's Exchange 2000 and Internet Explorer products.
ITworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
