Launch Printer Friendly Page Security TechCenter > > Microsoft Security Bulletin MS08-006

Microsoft Security Bulletin MS08-006 - Important

Vulnerability in Internet Information Services Could Allow Remote Code Execution (942830)

Published: | Updated:

Version: 1.1

General Information

Executive Summary

This important update resolves a privately reported vulnerability in Internet Information Services (IIS). A remote code execution vulnerability exists in the way that IIS handles input to ASP Web pages. An attacker who successfully exploited this vulnerability could then perform actions on the IIS server with the same rights as the Worker Process Identity (WPI). The WPI is configured with Network Service account privileges by default. IIS servers with ASP pages whose application pools are configured with a WPI that uses an account with administrative privileges could be more seriously impacted than IIS servers whose application pool is configured with the default WPI settings.

The security update is rated important for Microsoft Internet Information Services on all supported editions of Windows XP and Windows Server 2003. For more information, see the subsection, Affected and Non-Affected Software, in this section.

For more information about these vulnerabilities, see the Frequently Asked Questions (FAQ) subsection under the next section, Vulnerability Information.

Recommendation. Microsoft recommends that customers apply the update at the earliest opportunity.

Known Issues. None

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

Affected Software

Operating SystemComponentMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Windows XP Professional Service Pack 2Microsoft Internet Information Services 5.1Remote Code ExecutionImportantMS06-034
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2Microsoft Internet Information Services 6.0Remote Code ExecutionImportantMS06-034
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2Microsoft Internet Information Services 6.0Remote Code ExecutionImportantMS06-034
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2Microsoft Internet Information Services 6.0Remote Code ExecutionImportantMS06-034
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based SystemsMicrosoft Internet Information Services 6.0Remote Code ExecutionImportantMS06-034

Non-Affected Software

Operating System
Microsoft Windows 2000 Service Pack 4
Windows Vista
Windows Vista x64 Edition
Windows Vista Service Pack 1 (all editions)
Windows Server 2008 (all editions)

Note Supported editions of Windows Small Business Server 2003 contain the same affected code as Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2. However, for the ASP Vulnerability (CVE-2008-0075), default configurations of Windows Small Business Server 2003 have a greater exposure to the same vulnerability and therefore merit a severity rating of Critical.

Frequently Asked Questions (FAQ) Related to This Security Update

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

ASP Vulnerability - CVE-2008-0075

Update Information

Detection and Deployment Tools and Guidance

Security Update Information

Other Information

Support

  • Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
  • International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (February 12, 2008) Bulletin published.
  • V1.1 (February 20, 2008) Bulletin updated: update filenames changed in the file information table for all supported 32-bit editions of Windows XP.