Microsoft: Cyber criminals attack Unpatched IIS Bug

Microsoft has landed up in problems again, this time it with the bug in IIS which has been released into public earlier. Cyber criminals are beginning to exploit an unpathced bug in IIS.


The flaw can be exploited to let an attacker take control of an older IIS (Internet Information Services) 5.0 server running on Windows 2000, provided the hacker has some way of creating an FTP (File Transfer Protocol) directory on the server. Other IIS users could also be hit with a denial of service (DoS) attack.

This new code could be used to launch a DoS attack against IIS 5.0, 5.1, 6.0 and 7.0, and could affect users running IIS on Windows XP and Windows Server 2003, Microsoft said.And also for the attacker, he needs to be aware of reading the files on the system.Microsoft updated its security advisory on the issue late Thursday, saying it was starting to see "limited attacks that use this exploit code."

Microsoft will release its scheduled September security updates today, but it is not expected to fix this bug until it has had more time to test and develop a patch. Microsoft was not notified of the bug until the attack code was made public on Monday.