Microsoft responds to the remote control vulnerability exposed by the IIS service

On June 23, December 31, Microsoft's security department director Chris thover Badr told the media that after a rigorous investigation, no major security vulnerabilities were found in IIS services (Network Information Services.

It is reported that bud responded after the IIS Service reported a remote control vulnerability last week.

However, the investigation found that there is a defect in the IIS service that cannot handle the URL interval number. However, this defect does not allow hackers to bypass the security filtering software to upload executable code to the IIS server. Bud also believes that the default configuration of the IIS service in the same directory will prevent potential attacks. users do not have to worry about any problems as long as they follow normal security steps.

Last week, suo luoxi Dai Li, a researcher at Secunia, a professional vulnerability analysis company, pointed out that Microsoft's IIS service has a high-risk vulnerability. The cause of the vulnerability is that IIS parses the file name with semicolons or colons. Many Web applications are configured to reject upload with executable files, such as ASP (dynamic server homepage ).

However, hackers may pretend to use the malicious program xx.aspas as xx.asp..jpg or other harmless files to bypass firewall and other protection facilities.

According to Microsoft's official statement, users can operate properly to avoid harm caused by the IIS server vulnerability.