Re: Microsoft IIS problems (Current)

From: GVB (gvb_at_abused.com)
Date: 07/19/01


I have seen a few machines where IIS has been crashing all day. I am guessing
it is related to this idq.dll worm. All of these machines DO have the
Q300972 patch applied to them, yet they are still crashing.

I would like to test some things (repatching, applying service packs, etc..).
Does anyone have a proof of concept exploit for this problem?

Thanks!

gvb

On Thu, 19 Jul 2001, Jim Hribnak wrote:

>
> There appears to be a WIDE spread issue with IIS 4 and IIS 5 right now. The
> services will automatically shut down when attacked. There is patches (old
> Patches) that seem to fix the problem YET the patch says its for Microsoft
> Index server (a lot of people are not running Index server, yet this patch
> fixes the crashing problem.
>
> Upon further reading of the bulletin below it say
>
> "
> Affected Software:
>
> a.. Microsoft Index Server 2.0
> b.. Indexing Service in Windows 2000
> "
>
> Most people will not install this if they are not running the software
> listed above. The above should have also said IIS 4 and IIS 5 are affected.
>
> And it does if you read the technical section..
>
> http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
> bulletin/MS01-033.asp
>
> for IIS4 /NT4
> http://www.microsoft.com/ntserver/nts/downloads/critical/q300972/default.asp
>
> for IIS5/Win2000
> http://www.microsoft.com/windows2000/downloads/critical/q300972/default.asp
>
>
>
> ---------------------------------------
> Jim Hribnak
> Manager Communication Services
> Nucleus Inc.
> 403-209-0000
>
>
>
>



Relevant Pages

  • Re: IIS Admin & IIS hang regularly / PHP IIS 5 win 2k server
    ... It depends on what is crashing. ... It is rare for a program which crashes on ... IIS State would be a useful tool to ... The following corrective action will be taken in 1 ...
    (microsoft.public.inetserver.iis)
  • Re: Use of host headers fails after 4 hours
    ... If ASP or ASP.NET is crashing, then this would affect all ASP.NET/ASP pages, ... If you think ASP is crashing/hanging, and you are getting no errors in IIS ... > corrected after a complete reboot. ...
    (microsoft.public.inetserver.iis)
  • Re: IIS causing server crashes?
    ... As to IIS, it is unlikely the cause since it runs ... 2000 server has started crashing 4+ times per day recently. ... typical -- the server logs appear to stop mid-line anywhere from two to 45 ... minutes before an operating system crash, with eight minutes being the most ...
    (microsoft.public.inetserver.iis)
  • Re: IIS 6: Problem with ASP pages
    ... You need to identify if you are running in IIS5 Compatibility Mode or IIS6 ... and take a snapshot of the appropriate ... Right now, it sounds like *something* is crashing the IIS Admin Service, ...
    (microsoft.public.inetserver.iis)
  • Problem solved!!!
    ... When you install DPM on IIS, it apparently shoves metabase AccessFlags=30215 into every IIS site and Virtual Directory. ... Previous Posts In This Thread: ... Re: HTTP Error 403.2 - Forbidden: Read access is denied. ... on both the http://localhost/ and all remote machines as well. ...
    (microsoft.public.inetserver.iis)