Re: iis 6.0/win2k3 and isa vulnerability

From: Ken Schaefer (
Date: 11/02/04

  • Next message: Ken Schaefer: "Re: IIS 6.0 and win2k3 vulnerabilities"
    Date: Tue, 2 Nov 2004 13:48:36 +1100

    Please see answer in the inetserver.iis group


    "gotenks" <gotenks@dragonball.z> wrote in message
    >I ran a nessus (free open source vulnerability scanner)
    > scan on my 'public-ip/web server'. It was able to
    > identify the version of ISA and IIS that i was running.
    > It also reported a MS Predictable TCP sequence
    > vulnerability, i dont know if it was referring to
    > Win2k3/IIS 6.0 or ISA2K. The recommendation for the tcp
    > sequence vulnerability was to get a patch from the
    > vendor? It also recommended to use URLSCAN to hide the
    > identity of IIS 6.0? Does anyone know how i can get that
    > patch from MS for the tcp sequence vulnerability, and how
    > to configure urlscan to hide the IIS version im using?

  • Next message: Ken Schaefer: "Re: IIS 6.0 and win2k3 vulnerabilities"

    Relevant Pages

    • [NT] 15 August 2001 Cumulative Patch for IIS
      ... Microsoft has released an important patch for IIS administrators. ... * A denial of service vulnerability that could enable an attacker to ...
    • SecurityFocus Microsoft Newsletter #82
      ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft IIS HTR ISAPI Extension Buffer Overflow Vulnerability ... Microsoft IIS Help File Search Cross Site Scripting Vulnerability ... CSNews Professional Remote Command Execution Vulnerability ...
    • [NT] Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise
      ... This patch eliminates a newly discovered vulnerability affecting Internet ... in IIS 4.0 and 5.0, and could likewise be used to overrun heap memory on ... allowing code to be run on the server. ... * Microsoft has long recommended disabling HTR functionality unless there ...
    • FW: Microsoft Security Advisory MS 03-007
      ... am trying to find a vulnerability tester/script and I could test it out ... Department of the Army server that had been compromised and that this ... announcement covers IIS 5.1 but not IIS 6, ... How a Hacker Uses SQL Injection to Steal Your SQL Data! ...
    • [NT] Cumulative Patch for Internet Information Service (28 May 2003)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: ... security patches released for IIS 4.0 since Windows NT 4.0 Service Pack ... An attacker would need the ability to upload a Server-side ... * A denial of service vulnerability that results because IIS 5.0 and 5.1 ...