Microsoft urges patch application to fight latest server threat

Computerworld - Microsoft Corp. is telling systems administrators to make sure they have installed a previously announced patch to guard against security problems currently affecting Web sites using the company's Internet Information Services (IIS) 5.0 server.
According to an advisory released by Microsoft, companies that haven't yet installed Update 835732 detailed in Microsoft Security Bulletin MS04-011 appear to be at risk from the ongoing attack.
Users who have already deployed Windows XP Service Pack 2 RC2 appear to be protected, the company said.
The Microsoft advisory is in response to what appears to be a continuing attack against IIS 5.0 servers worldwide. The attack, first discovered yesterday by several security firms, involved a group of Russian hackers breaking into Web sites running IIS 5.0 (see story).
Stephen Toulouse, program manager at Microsoft's security response center, said the software vendor began investigating the problem after being told about it last night by customers.
All early indications point to IIS 5.0 servers being affected, he said, although Microsoft hasn't yet positively identified the flaw being exploited. Evidence so far suggests that the attackers are breaking into IIS servers via a previously disclosed buffer-overrun problem in the Private Communications Transport protocol, which is part of the Microsoft Secure Sockets Layer library.
That problem was addressed with the MS04-011 patch, which is why Microsoft recommends that users install it, he said.
Meanwhile, desktop systems can be infected via two vulnerabilities in Internet Explorer, one of which has an available patch and one that doesn't, Toulouse said.

Microsoft is working on a patch for the problem, Toulouse said, without specifying when the company might have one ready. But users who keep their systems updated with the latest antivirus patches or have the high-security setting turned on while browsing the Internet should be reasonably protected, he said.
Following Microsoft's advice would be a "prudent thing to do" for now, said Marty Lidner, an incident-handling team leader at the CERT Coordination Center at Carnegie Mellon University in Pittsburgh.
It would also be smart for administrators running IIS 5.0 to ensure there is no unusual JavaScript code appended to the bottom of the Web pages served up by their sites, said Russ Cooper, editor of "NT Bugtraq" and an analyst at Herndon, Va.-based TruSecure Corp.
He also urged them to "check to see if you have document footers enabled when they are not supposed to be."
According to an advisory by Computer Associates International Inc., a Trojan horse program named JS. Toofer or JS. Scrob is installed on vulnerable IIS