Iis|server| Security involves procedures:
Microsoft IIS Server
Describe:
IIS enables users who have permission to upload and use ASP programs to change any file
With:
This is a very serious vulnerability for IIS, even IIS4.0, which still does not fix this vulnerability: you build
such as http://www.cnns.net/frankie/text/aspwrite.txt such a simple ASP program named Write.asp, note that the program does not allow line-wrapping!
It is then uploaded to any web directory (allowing script execution), such as:
Http://www.xxx.com/frankie/write.asp
Then enter the address in the browser
This will replace the home page! Red Word Black Bottom, show: This page is hacked by small-hacker!
Solution:
No related patches, only non-admin users can be prevented from uploading ASP programs and executing scripts
Security recommendations:
Administrators should be aware of the fact that if you open ASP upload and script execution permissions to the user, it is tantamount to handing over control of the entire system to the user. So don't open it easy.
Put the permissions of ASP to the general user
Related downloads:
Http://www.cnns.net/frankie/text/aspwrite.txt
