May 28th, 2003, 07:44 PM
Flaw in Windows Media Services
You can find more info and the patches for this HERE
Microsoft Windows Media Services is a feature of Microsoft Windows 2000 Server, Advanced Server, and Datacenter Server and is also available as a downloadable version for Windows NT 4.0 Server. Windows Media Services contain support for a method of delivering media content to clients across a network known as multicast streaming. In multicast streaming however, the server has no connection or knowledge of the clients that may be receiving the stream coming from the server. To facilitate logging of client information for the server Windows 2000 includes a capability specifically designed for that purpose. . To help with this problem, Windows 2000 includes logging capabilities for multicast and unicast transmissions.
There is a flaw in the way in which nsiislog.dll processes incoming requests. A vulnerability exists because an attacker could send specially formed communications to the server that could cause IIS to stop responding to Internet requests
May 29th, 2003, 02:51 PM
Nice post, and just as a FYI for those AOers who use NESSUS, a NASL has been added today (5/29/03) that will check IIS servers for this vulnerability.
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden