The patch announced by Microsoft on the 17th March 2003 fixed a security vulnerability in the core of the Windows 2000 operating system. This flaw was actively being exploited through WebDAV requests to Microsoft's Internet Information Server 5. It must be stressed that IIS was simply the attack vector; the method or route used to actually exploit the flaw. The problem, however, is much wider in scope than just simply machines running IIS. Researchers at NGSSoftware have isolated many more attack vectors including java based web servers and other non-WebDAV related issues in IIS. Due to this, NGSSoftware urge Windows 2000 users to apply the patch. For a paper that examines the vulnerability in detail, please read http://www.ngssoftware.com/papers/ms03-007-ntdll.pdf . Cheers, David Litchfield NGSSoftware Ltd +44(0)208 401 0070 http://www.ngssoftware.com/
This archive was generated by hypermail 2b30 : Fri Mar 21 2003 - 10:46:37 PST