Re: IIS still revealing paths for web directories

From: Frank Knobbe at Home (FKnobbeat_private)
Date: Sat Jan 15 2000 - 21:50:07 PST

  • Next message: Thomas Maschutznig: "Re: ICQ Buffer Overflow Exploit"

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    > -----Original Message-----
    > From: Chris Tobkin [mailto:tobkinat_private]
    > Sent: Wednesday, January 12, 2000 2:08 PM
    >
    > > The same problem still exists on IIS4 (tested with SP5 -
    > didn't try on
    > > SP6).
    >
    > Still exists as far back as IIS3 also. (SP6a)
    
    Can't reproduce the problem with IIS3 and SP6.
    
    BTW: I'm running IIS3 on several servers without problems. I did not
    want to upgrade to IIS4 due to the complexity of its internal
    processes (and all those exploits that followed). My main complaint
    is still that I do not want to run IIS under the system account as
    IIS4 requires.
    
    Anyway, a time will come when we need to upgrade to W2K and IIS5.
    Does anyone have a comparison or analysis of IIS5 in respect to
    security (data channels, posting acceptors, etc)?
    
    Regards,
    Frank
    
    
    -----BEGIN PGP SIGNATURE-----
    Version: PGP Personal Privacy 6.5.1
    Comment: PGP or S/MIME (X.509) encrypted email preferred.
    
    iQA/AwUBOIFcCURKym0LjhFcEQI+XwCeM4vv5ILglddvWw1LIWYBNOPifSEAoJ7z
    /+V1C97k2f+QTjNw9YGgmA90
    =qq7D
    -----END PGP SIGNATURE-----
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:28:33 PDT