Microsoft IIS Patch Level Security PCI loophole

Hi,

I run a security scanner for PCI credit card(Visa,MC) shopping cart
compliance periodically on my web site, which, upon a recent site scan
on our domain, returned a failing test. The reason that the test did
not pass was because it maintains that the Microsoft IIS Server is
running at a patch level (SP1 specifically) which is lower than the
current patch level, hence the failed test. On the flip side of the
coin, the test is obviously not foolproof and it maintains in the
commentary field the following info:

"The Patch level (Service Pack) of the remote IIS server appears to be
lower than the current IIS service pack level. As each service pack
typically contains many security patches, the server may be at risk.

Note that this test makes assumptions of the remote patch level based
on static return values (Content-Length) within a IIS Server's 404
error message. As such, the test can not be totally reliable and
should be manually confirmed.

Note also that, to determine IIS6 patch levels, a simple test is done
based on strict RFC 2616 compliance. It appears as if IIS6-SP1 will
accept CR as an end-of-line marker instead of both CR and LF."

The Security companies contention (SecurityMetrics) is that it is
better to receive a false positive than to miss an actual threat,
hence a scan which isn't actual proof at all that the web server isn't
compliant. If you note the response above, they tell me the test makes
"assumptions" & the server "*seems" to be running at SP1. If you will
also note in the second paragraph above that the test makes the
assumptions based on the IIS servers 404 error message. My question
is, can this be corrected by something as modifying how the server
handles 404 messages or another setting-assuming the 404/Content-
Length is somehow to blame? In my control panel IIS settings I have
tried both changing the 404 message from the html custom error message
resident server side to the default setting -and back- to no avail.
(Note: I don't have access to the servers web.config or machine.config
file)

Here is the 404 html header info:

HTTP/1.1 404 Not Found
Content-Length: 103
Content-Type: text/html
Server: Microsoft-IIS/6.0
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Date: Fri, 22 Feb 2008 10:14:04 GMT
Connection: close

I have opened up a support ticket with my web host
(www.hostmysite.com) but they have assured me over the phone that they
have the latest patch levels on their server (after testing them out)
Where to go. What to do...Very frustrating...Any advice is much
appreciated.
Thank you for your time.
.

Relevant Pages

  • Re: Microsoft IIS Patch Level Security PCI loophole
    ... current patch level, hence the failed test. ... "The Patch level of the remote IIS server appears to be ... assumptions based on the IIS servers 404 error message. ...
    (microsoft.public.inetserver.iis.security)
  • Re: How to Maintain an IIS Server?
    ... Have you looked at the resources on the Microsoft Security website? ... "secure" for me because I face different risks to you. ... Also, in addition to securing the IIS server, make sure you secure your ASP ...
    (microsoft.public.inetserver.iis.security)
  • Re: Should IIS svr NOT be in domain
    ... > security risk for the IIS server to be a domain member. ... SBS is NOT necessarily something you should be taking your security best ... All accounts on DCs are domain accounts, ...
    (microsoft.public.windows.server.security)
  • Re: Web Services over IIS using SSL
    ... I think Basic auth/SSL for web services is fine and should provide good ... The downside with using transport level security is that your security is ... XML firewall(between iis aspx server and web services server) and ... > firewall is securing the calls between the iis server and web services ...
    (microsoft.public.dotnet.security)
  • Re: Getting "The function requested is not supported" -IIS 6
    ... > static pages) that has two security templates applied: ... > Member Server Baseline and High Security - IIS Server. ... > fine until I apply either of the two security templates. ...
    (microsoft.public.inetserver.iis.security)