Subject: FYI: DAV-related buffer overflow exploit in IIS 5

From: "Jim Whitehead" <[email-masked]>
Date: Mon, 17 Mar 2003 22:32:10 -0800

FYI.

So, how many implementors on the list are confident *you* don't also have a
buffer overflow exploit lurking in your code?

- Jim

http://www.cert.org/advisories/CA-2003-09.html

 CERT® Advisory CA-2003-09 Buffer Overflow in Microsoft IIS 5.0
Original issue date: March 17, 2003
Last revised: Mon Mar 17 14:34:35 EST 2003
Source: CERT/CC

A complete revision history is at the end of this file.

Systems Affected
Systems running Microsoft Windows 2000 with IIS 5.0 enabled
Overview
A buffer overflow vulnerability exists in Microsoft IIS 5.0 running on
Microsoft Windows 2000. IIS 5.0 is installed and running by default on
Microsoft Windows 2000 server products. This vulnerability may allow a
remote attacker to run arbitrary code on the victim machine.

An exploit is publicly available for this vulnerability, which increases the
urgency that system administrators apply a patch.

---

From: [email-masked]
Date: Tue, 18 Mar 2003 21:14:55 +0100 (MET)

"Jim Whitehead" <[email-masked]>
>  CERTr Advisory CA-2003-09 Buffer Overflow in Microsoft IIS 5.0
A provocing question. So I think I will answer it:
I'm pretty sure :-)
I won't have a single line of C (The mother of all viruses) in my code and also on
the whole server.
In Oberon a buffer overflow can at most crash my WebDAV process and that's it.

Edgar 

-- 
[email-masked]                  "http://www.edgarschwarz.de"
"http://www.edgar-schwarz.de/forum/oberon"    Running Active Oberon
Make it as simple as possible, but not simpler.     Albert Einstein