RE: Rash of navy web site defacements

From: Otto.Dandenellat_private
Date: Sat Jun 02 2001 - 04:52:31 PDT

  • Next message: macdaddyat_private: "Re: ISP Filtering (Survey of Sorts)"

    Andrew Thomas wrote:
    
    > As much as everyone has knocked M$ products, IIS in particular,
    > most of the most recently released vulnerabilities are entirely
    > avoidable *WITHOUT* the hotfixes in question.
    > 
    > 1 - Go through the relevant MS issued security checklist (Securing
    > IIS4 or IIS5)
    > 2 - Set ACL's sensibly: why would IUSR/IWAM accounts need to execute
    > anything in the winnt\system directory, or most places for 
    > that matter?
    
    Actually, there are a few cases when the IUSR account should have execute
    permissions in the winnt\system directory. Most notably, java components
    called by ASP scripts should be placed in the winnt\system32\java\trustlib
    directory and registered with regsvc.
    
    That aside, your point is valid.
    
    Sincerely
    
    / Otto Dandenell
    
    > 3 - remove extension mappings for handlers you don't need
    > 4 - remove virtual directory mappings you don't need/the like
    >  (/msadc, /scripts, ...)
    



    This archive was generated by hypermail 2b30 : Sat Jun 02 2001 - 07:07:14 PDT