IIS 6.0 Vulnerabilities

IIS vs. Apache ?

TrackBack — Tue, 19 Oct 2004 06:47:00 GMT

re: IIS 6.0 Vulnerabilities

bernard — Mon, 21 Jun 2004 15:47:00 GMT

Hi Ray,
Just set it to false, and set AspScriptErrorMessage for the error msgs.

re: IIS 6.0 Vulnerabilities

bernard — Sat, 19 Jun 2004 05:58:00 GMT

Grat article with lots of good info. I would like to script (adsutil.vbs) the change so IIS won't "Send detailed ASP error messages to client" (Default Web Site|Home Directory|Configuration|Debugging Tab). What value do I set in the metabase (AspScriptErrorSentToBrowser)?
Thanks,

re: IIS 6.0 Vulnerabilities

bernard — Sun, 13 Jun 2004 00:53:00 GMT

Cool. I didn't know that. Thanks Alun.

re: IIS 6.0 Vulnerabilities

bernard — Sat, 12 Jun 2004 04:24:00 GMT

Just a quick note in passing on the item "PCT Vulnerability - CAN-2003-0719" - PCT is not enabled by default on Windows Server 2003, and it's difficult to imagine too many situations where an admin would enable it. For the vulnerability to work, PCT would have to be enabled - enabling SSL is not enough.

re: IIS 6.0 Vulnerabilities

bernard — Fri, 11 Jun 2004 02:26:00 GMT

Kudos on a well written post :)

Security is the sum of all the parts and it's only as strong as it's weakest link.

IIS 6.0 (which is yet to have it's first security release) is [b]VERY SECURE[/b]. It represents the fruitition of MS's efforts in strengthening it's security products.

Russ is somewhat correct, in that to build a secure MS Internet or Intranet server, you need to consider all the parts (Windows, IE, etc), and thus you can arrive at dozens of required patches. Still, IIS is just a part and saying that [b]it[/b] has the number of vulnerabilities Russ identified is misleading.

Respectfully, Harry

IIS 6.0 Research

TrackBack — Thu, 10 Jun 2004 18:01:00 GMT

re: IIS 6.0 Vulnerabilities

bernard — Thu, 10 Jun 2004 17:02:00 GMT

And then there is the obvious component that the number of vulnerabilities can be further reduced by the fact that some of the 21 W2K3 vulnerabilities just do not apply to an IIS 6.0 Server maintained by anyone with sound mind and judgement.

As far as the 22 IE vulnerabilities, how long has it been SOP not to perform casual web browsing from a production server?