RE: Rash of navy web site defacements

From: Andrew Thomas (andrewat_private)
Date: Fri Jun 01 2001 - 01:49:28 PDT

  • Next message: Booth, David CWT-MSP: "RE: ISP Filtering (Survey of Sorts)"

    > -----Original Message-----
    > From: Jay D. Dyson [mailto:jdysonat_private]
    > Sent: Thursday, May 31, 2001 7:36 PM
    > To: Incidents List
    > Cc: Dan Schrader
    > Subject: Re: Rash of navy web site defacements
    --snip--
    > 	Exploiting IIS isn't simply trivial.  You have to tie a board
    > across your butt to keep from falling in.
    
    As much as everyone has knocked M$ products, IIS in particular,
    most of the most recently released vulnerabilities are entirely
    avoidable *WITHOUT* the hotfixes in question.
    
    1 - Go through the relevant MS issued security checklist (Securing
    IIS4 or IIS5)
    2 - Set ACL's sensibly: why would IUSR/IWAM accounts need to execute
    anything in the winnt\system directory, or most places for that matter?
    3 - remove extension mappings for handlers you don't need
    4 - remove virtual directory mappings you don't need/the like
     (/msadc, /scripts, ...)
    
    With these steps, while I remain open to correction, I don't see how
    any of the unicode, cgi double-decode or recent .printer overflows
    would have been easily exploitable.
    
    Take care,
      Andrew
    -
    Andrew Thomas
    office: +27 21 4889820
    facsimile: +27 21 4889830
    mobile: +27 82 7850166
     "One trend that bothers me is the glorification of
    stupidity, that the media is reassuring people it's 
    alright not to know anything. That to me is far more 
    dangerous than a little pornography on the Internet." 
      - Carl Sagan
    



    This archive was generated by hypermail 2b30 : Fri Jun 01 2001 - 16:17:28 PDT