Hackers already exploiting IIS flaws

Microsoft urges researchers to disclose vulnerabilities responsibly.

Microsoft has revealed that hackers are already exploiting newly disclosed vulnerabilities in its Internet Information Services (IIS) web server software.

Exploit code for the first flaw was posted on Monday, which would allow hackers to remotely take control of an IIS 5.0 server. New code was then posted on Thursday which takes advantage of vulnerabilities in IIS 5.0, IIS 5.1, IIS 6.0 and IIS 7.0 to allow hackers to launch denial of service attacks against these systems, as long as they are running the FTP Service, said Microsoft.

Redmond was forced to update its security advisory warning that it is now seeing “limited attacks that use this exploit code”.

“Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary,” the advisory continued.

Although Microsoft is due to release its September security updates on patch Tuesday next week, it is widely believed that the new vulnerabilities were disclosed to recently for the Redmond security team to be able to deliver a working fix in time.

In a blog posting, Microsoft blamed the current, albeit limited, attacks on the fact that the original vulnerabilities were published on the internet before the firm had a chance to work on a fix.

“We continue to encourage responsible disclosure of vulnerabilities,” the post continued.

“We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.”