Overview
A vulnerability in the Microsoft Internet Information Services (IIS) FTP Service may allow denial-of-service attacks.
A vulnerability in the Microsoft Internet Information Services (IIS) FTP Service may allow denial-of-service attacks. The flaw is specific to the method used by the FTP server to handle list commands. An attacker can issue a specially-crafted list command to a vulnerable server to cause the service to become unresponsive (DoS) or restart.
Attack VectorMalicious remote network traffic
User Interactionno user interaction is needed
Vendor StatusResponded and patched
Vulnerable Systems
Iis
7.0,
Timeline
Vendor has provided a patch.
Recommendations
The vendor has released a patch to address this issue:
http://www.microsoft.com/technet/security/bulletin/ms09-053.mspx
Recommendations McAfee Product Mitigation
Additional Resources
Microsoft Security Bulletin MS09-053 - Important Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (975254)
http://www.microsoft.com/technet/security/bulletin/ms09-053.mspx