Flaw in Windows Media Services

AOers,

Quote:

---

Microsoft Windows Media Services is a feature of Microsoft Windows 2000 Server, Advanced Server, and Datacenter Server and is also available as a downloadable version for Windows NT 4.0 Server. Windows Media Services contain support for a method of delivering media content to clients across a network known as multicast streaming. In multicast streaming however, the server has no connection or knowledge of the clients that may be receiving the stream coming from the server. To facilitate logging of client information for the server Windows 2000 includes a capability specifically designed for that purpose. . To help with this problem, Windows 2000 includes logging capabilities for multicast and unicast transmissions.

There is a flaw in the way in which nsiislog.dll processes incoming requests. A vulnerability exists because an attacker could send specially formed communications to the server that could cause IIS to stop responding to Internet requests

---

You can find more info and the patches for this HERE

Bye,

DKRR

Nice post, and just as a FYI for those AOers who use NESSUS, a NASL has been added today (5/29/03) that will check IIS servers for this vulnerability.

:)