Microsoft Security: IIS Vulnerability, Leaked Office 2010 Tech Preview Infected
Two pieces of security news to report from the Microsoft camp: the first one is that IIS (Internet Information Services) is plagued by a 0-day vulnerability that if exploited by a person with malicious intent via a specially crafted anonymous HTTP request could allow the attacker access to locations that require authentification; the second is that the leaked Office 2010 Technical Preview is infected with malware (similar to the leaked Windows 7 RC versions which were infected by a Trojan which attempted to build a botnet – details here).
Security Response Communications Lead with Microsoft, Christopher Bud, comments on the IIS vulnerability: “wanted to let you know that we have just posted Microsoft Security Advisory (971492). This advisory contains information regarding public reports of a vulnerability in Microsoft Internet Information Services (IIS) that could allow Elevation of Privilege. Products affected are IIS 5.0, IIS 5.1, and IIS 6.0. The advisory contains guidance and workarounds that customers can use to help protect themselves. We will continue to monitor the situation and post updates to the advisory and the MSRC Blog as we become aware of any important new information. At this time, we are not aware of any known attacks that attempt to use this vulnerability.”
According to Christopher Bud, the issue is caused by an elevation of privilege vulnerability that affects the way the WebDAV extension handles HTTP requests. Access to locations that regularly require authentification can be obtained by someone who uses an anonymous HTTP request to exploit the vulnerability. A patch for this security vulnerability will be provided by the Redmond-based software developer as part of its Patch Tuesday program; if the vulnerability will be actively exploited, then Microsoft will issue an out-of-date patch.
The Technical Preview version of the upcoming Office 2010 productivity suite that has been leaked and is available for download via torrent sites also poses a security risk to your PC. It seems the software is infected with viruses – this information was acknowledged by the Office 2010 team.
“I wanted to […] acknowledge the information that you have seen today around bits of Office 2010 being leaked. While all of us here are happy to see the incredible excitement and engagement (and are absolutely chomping at the bit to reach the July milestone) we aren’t quite ready to release the technical preview bits. I would encourage all of you to wait until the official bits are available to ensure the best possible experience and not miss out on anything we may include. As a heads up, because we want to ensure our customers are safe, we have been monitoring various torrents and already detected quite a few that were infected. Please be aware that if you download this torrent there is a very good chance you are also getting some unexpected malware with it,” explained Office TPM, Reed Shaffner.
Tags: Microsoft, Security, IIS, Internet Information Services, Office 2010, Technical Preview
Security Response Communications Lead with Microsoft, Christopher Bud, comments on the IIS vulnerability: “wanted to let you know that we have just posted Microsoft Security Advisory (971492). This advisory contains information regarding public reports of a vulnerability in Microsoft Internet Information Services (IIS) that could allow Elevation of Privilege. Products affected are IIS 5.0, IIS 5.1, and IIS 6.0. The advisory contains guidance and workarounds that customers can use to help protect themselves. We will continue to monitor the situation and post updates to the advisory and the MSRC Blog as we become aware of any important new information. At this time, we are not aware of any known attacks that attempt to use this vulnerability.”
Advertising
According to Christopher Bud, the issue is caused by an elevation of privilege vulnerability that affects the way the WebDAV extension handles HTTP requests. Access to locations that regularly require authentification can be obtained by someone who uses an anonymous HTTP request to exploit the vulnerability. A patch for this security vulnerability will be provided by the Redmond-based software developer as part of its Patch Tuesday program; if the vulnerability will be actively exploited, then Microsoft will issue an out-of-date patch.
The Technical Preview version of the upcoming Office 2010 productivity suite that has been leaked and is available for download via torrent sites also poses a security risk to your PC. It seems the software is infected with viruses – this information was acknowledged by the Office 2010 team.
“I wanted to […] acknowledge the information that you have seen today around bits of Office 2010 being leaked. While all of us here are happy to see the incredible excitement and engagement (and are absolutely chomping at the bit to reach the July milestone) we aren’t quite ready to release the technical preview bits. I would encourage all of you to wait until the official bits are available to ensure the best possible experience and not miss out on anything we may include. As a heads up, because we want to ensure our customers are safe, we have been monitoring various torrents and already detected quite a few that were infected. Please be aware that if you download this torrent there is a very good chance you are also getting some unexpected malware with it,” explained Office TPM, Reed Shaffner.
Tags: Microsoft, Security, IIS, Internet Information Services, Office 2010, Technical Preview
I Hope you LIKE this blog post! Thank you!
What do YOU have to say about this
blog comments powered by Disqus
Popular News
By George Norman on 28 May 2012
Mozilla introduced a new program meant to educate millions of people, the Mozilla Webmaker program.
By George Norman on 26 May 2012
Piriform updated its products, making CCleaner less annoying and Defraggler a lot faster.Related News
By George Norman on 12 Mar 2012
A total of six security bulletins will be released on Tuesday, the 13th of March by Microsoft as part of its Patch Tuesday program
By George Norman on 10 Feb 2012
Microsoft has just announced that this February, as part of the Patch Tuesday program, it will roll out a grand total of 9 security bulletins to all customers all over the world.
By George Norman on 06 Jan 2012
On the 10th of January 2012, Microsoft will release seven security bulletins as part of its Patch Tuesday program. The aforementioned bulletins are meant to address a total of 8 vulnerabilities that plague the Microsoft Windows operating system and
By George Norman on 02 Dec 2011
The topic of computer security came up just the other day when I was out with friends. One said he relies on Kaspersky because it’s a properly good security solution, another said he relies on BitDefender becauseAdvertising
Hot Software Updates
Top Downloads
2.
Opera5.
Trillian8.
AIM9.
Skype10.
Ad-Aware12.
Nero13.
Google Earth14.
Picasa15.
Winamp16.
iTunes17.
RealPlayer18.
uTorrent19.
eMule20.
WinRAR21.
BitComet22.
WinZip23.
Shareaza24.
CCleaner25.
Recuva26.
Tweak UI27.
CuteFTP Home29.
Adobe Reader30.
NewsPiperBecome A Fan!
Link To Us!
Microsoft Security: IIS Vulnerability, Leaked Office 2010 Tech Preview Infected
HTML Linking Code
HTML Linking Code