| VID |
26533 |
| Severity |
30 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The Hotfix (MS10-065, 2267960) for 'Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution' has not been applied.
This security update resolves two privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Information Services (IIS). The most severe of these vulnerabilities could allow remote code execution if a client sends a specially crafted HTTP request to the server. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
The security update addresses the vulnerabilities by modifying the way that IIS handles specially crafted HTTP requests.
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://www.microsoft.com/technet/security/Bulletin/MS10-065.mspx
* Platforms Affected:
Microsoft Windows XP SP3, x64 SP2
Microsoft Windows Server 2003 SP2, x64 SP2, SP2 for Itanium
Microsoft Windows Vista SP1/SP2, x64 SP1/SP2
Microsoft Windows Server 2008/SP2, x64/SP2, for Itanium, SP2 for Itanium
Microsoft Windows 7, x64
Microsoft Windows Server 2008 R2 x64, for Itanium |
| Recommendation |
Apply the appropriate patch (2267960) for your system, as listed in Microsoft Security Bulletin MS10-060 at http://www.microsoft.com/technet/security/bulletin/ms10-065.mspx |
| Related URL |
CVE-2010-1899,CVE-2010-2730,CVE-2010-2731 (CVE) |
| Related URL |
41314,43138,43140 (SecurityFocus) |
| Related URL |
(ISS) |
|
