Microsoft IIS 7.5/6.0 Unpatched Authentication Bypass

2012.07.17
Credit: Kingcope
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-592

It seems Microsoft doesn't want to patch the vulnerabilities I posted back in June, at least not in the July update. The posting included some important bugs in the Internet Information Services, one of their flagship products: http://seclists.org/fulldisclosure/2012/Jun/189 The July Security Bulletin doesn't mention any bug. http://technet.microsoft.com/en-us/security/bulletin/ms12-jul I wonder if Microsoft will silently patch the vulnerabilities or just bluntly ignore them. I understand that Microsoft doesn't want to make a big deal about the impact and exposure like in the past, yet I believe that admins should be informed about the threats by their very side. You have to remember that I put much effort into finding these vulnerabilities and you get them for free. With resolving the bugs Microsoft proves that they care about security even if these vulnerabilties where disclosed uncoordinated yet free to patch. /Kingcope

References:

http://cxsecurity.com/issue/WLB-2012060118
http://seclists.org/fulldisclosure/2012/Jun/189
http://technet.microsoft.com/en-us/security/bulletin/ms12-jul


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top