Re: Would IIS auth prevent buffer overflow attac
"Roger A. Grimes" <[email protected]> Sat, 27 Aug 2005 16:22:32 -0400
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <096A04F511B7FD4995AE55F13824B8330C70B7@banneretcs1.local.banneretcs.com> |
--See below. --Sorry for the late reply, I've been transversing countries a lot these days. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Stephen Shepherd Sent: Thursday, August 25, 2005 11:16 AM To: [email protected] Subject: Re: [Intrusions] Would IIS auth prevent buffer overflow attac This particular installation is IIS6. I agree that auth would not limit the exploit of other services. Assuming anonymous access is not allowed and the attacker could successfully authenticate. However I am thinking that if Auth is enabled then: 1.) w/o credentials the attack would have to be against the auth module --again, all web requests are authenticated...either against a real account or the IUSR account, so if all things are equal, buffer overflow will be equally as likely against any encountered/involved files/services. 2.) the server would be better protected against mindless worms that just scan and exploit --Maybe, maybe not. Overall, its probably easier to secure a completely anonymous web site than one that requires real logon names and passwords. --Another good hint is to require a host header on your web site (ex. www.example.com). Most worms and scanning tools work on IP addresses, so requiring that all HTTP requests use the formal URL will decrease many/most automated attacks. You mention http.sys. Are you saying that this driver pre-processes all requests? If that is the case both http.sys and the auth module would be potential targets. Correct? --Yes, http.sys pre-processes all requests. Yes on both accounts, but remember auth is being called regardless because IUSR account is authenticating. Roger ************************************************************************ *** *Roger A. Grimes, Banneret Computer Security, Consultant *CPA, CISSP, MCSE: Security (2000/2003/MVP), CEH, CHFI, TICSA *email: [email protected] *cell: 757-615-3355 *Author of Honeypots for Windows (Apress) *http://www.apress.com/book/bookDisplay.html?bID=281 ************************************************************************ **** _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions