Underground homes in on Microsoft server flaw

For at least the past week, members of the computer underground have been discussing ways to take advantage of a serious, unreported flaw in Microsoft's Web server software.

The flaw allows malicious users to read and execute files on Web sites simply by requesting a specific Web address. Microsoft released a bulletin about the problem Tuesday, urging customers to patch its systems and warning "It is important not to underestimate the damage that a malicious user could cause."

There are no reports yet of the exploit being used, but since the underground learned of the flaw before Microsoft, it's possible Web sites have been attacked using it for some time.

Dozens of security vulnerabilities are discovered every day, most by zealous researchers or hobbyists who immediately report the problems to software companies. But some flaws are found by the computer underground and are kept secret for days, weeks, even months. Computer hackers call them "zero-day" exploits. So long as they remain "zero-day", computer intruders can have a field day with them, sure that there is no known patch for the problem.

It's not known how long this new Web server flaw has been known in the underground, but the problem was being discussed openly on a hacker bulletin board for at least a week.

But posters to that board offered an imperfect explanation of the flaw, and it appears they didn't quite grasp the extent of the problem.

Microsoft did. It had its network of customers service representatives visit thousands of customers around the world Saturday, Sunday, and Monday, insisting that they install the patch immediately.

"We told them, 'Call your customers, wake them up, get their systems patched," said Scott Culp, who runs Microsoft's emergency response team.

The flaw allows a malicious computer user armed with a single, specially formed URL to access any files on a Web server. The intruder can also run programs on the server, but wouldn't be able to view administrative passwords. Still, the problem is severe, Culp said.

"For our customers who haven't installed the patch yet, whatever they're doing, they need to stop and go get the patch right now," he said.

Coincidentally, a patch Microsoft developed in August already fixes the problem. But Culp said many Microsoft customers hadn't applied that patch yet.

The first mention of a problem came 10 October, when an anonymous poster bragged on a computer hacker bulletin board that he or she could execute commands on Microsoft-powered Web servers simply by appending a specific string to the end of a Web address.

That post eventually caught the attention of a researcher who goes by the pseudonym Rain Forest Puppy, who brought the problem to Microsoft's attention Friday.

Microsoft's Web server software, called IIS, is supposed to prevent requests for any file that's not meant to be displayed on a Web page. But by including special characters in the URL, an attacker is able to circumvent the filter meant to prevent such requests. Then the intruder can view any file that's sitting on the same hard drive that serves up Web pages. The fact that problem was discussed in so open a forum suggested that it may have been used for some time to attack Web sites, according to Elias Levy, who administers the BugTraq mailing list where the flaw was released publicly Tuesday.

"None of the people that responded to the original message were able to reproduce the problem. But who knows about the ones that did not respond?" Levy said.

"This goes to show that even today many vulnerabilities are discovered in the underground before they show up in public, which is why giving information to the public as soon as possible should be a high priority to anyone disclosing vulnerabilities."

Culp said Microsoft monitored hacker discussion groups throughout the weekend, and while it was clear some notion of the flaw had been discussed, it didn't appear anyone outside Microsoft and Rain Forest Puppy knew exactly how it worked.

"We didn't see anything that suggested it had gotten out," Culp said, but added, "It's impossible to say how widespread knowledge is in underground."

Take me to Hackers

To have your say online click on the TalkBack button and go to the ZDNet News forum.

Let the editors know what you think in the Mailroom. And read what others have said.