Alert GCSA-10133 - Vulnerabilita' in Microsoft IIS (MS10-065)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
******************************************************************
Alert ID : GCSA-10133
Data : 21 Settembre 2010
Titolo : Vulnerabilita' in Microsoft IIS (MS10-065 - 2267960)
******************************************************************
:: Descrizione del problema
Sono state riscontrate alcune vulnerabilita' in Microsoft Internet
Information Service (IIS), che potrebbe essere sfruttate da attaccanti
remoti per eseguire codice arbitrario o per ottenere il controllo
completo di un sistema vulnerabile.
La piu' grave di queste vulnerabilita' potrebbe essere sfruttata da un
attaccante remoto non autenticato per eseguire codice arbitrario,
se un client manda al server pacchetti HTTP malevoli appositamente
predisposti.
:: Software interessato
Microsoft Internet Information Services (IIS) version 5.1
Microsoft Internet Information Services (IIS) version 6.0
Microsoft Internet Information Services (IIS) version 7.0
Microsoft Internet Information Services (IIS) version 7.5
:: Impatto
Accesso al sistema
Compromissione del sistema
:: Soluzioni
Applicare la patch:
http://www.microsoft.com/technet/security/bulletin/ms10-065.mspx
:: Riferimenti
Microsoft Security Bulletin
http://www.microsoft.com/technet/security/bulletin/ms10-065.mspx
Secunia:
http://secunia.com/advisories/40412/
http://secunia.com/advisories/41375/
http://secunia.com/advisories/41399/
VuPen:
http://www.vupen.com/english/advisories/2010/2386
Mitre's CVE ID
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1899
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2731
-----BEGIN PGP SIGNATURE-----
iQCVAwUBTJiDWfOB+SpikaiRAQLwTgP6Ai8lMLlc5IX/8IRO0OfHD6EiyvzmKOHm
6/GfxC+V4irm36dJUMU6Co931Z8Rzudw6dotF0E5oyMKxVgtfYSpKyt7U9kugMz7
mGbxt9ug1d1I68B5ueZ1hwdmK6uLjxMGGhq8K5KlGzOo+23NxncVjLwZR8VJj0jT
ngdFKU1jfVc=
=OATU
-----END PGP SIGNATURE-----