Bugtraq mailing list archives
Re: Alert: MS IIS 4 / IS 2 (Cerberus Security Advisory CISADV0001 26)
From: caveg () HASTINGS-ENT COM (Cave, Glynis)
Date: Mon, 31 Jan 2000 11:20:26 -0600
Also, the IDQ.dll file properties do not show what MS indicates on their bulletin: "You've installed the patch correctly if IDQ.dll has the following properties... Date: January 26, 2000 Size: 193,296 bytes" Has anyone heard from Microsoft about this?
I apply the patch from Microsoft and it doesnt change the problem. I test this after and the problem are the same *** WARNING **** Even if you have no .htw files on your system you're probably still vulnerable! A quick test to show if you are vulnerable: go to http://YOUR_WEB_SERVER_ADDRESS_HERE/nosuchfile.htw If you receive a message stating the "format of the QUERY_STRING is invalid" you _are_ vulnerable.
This test is to see if you're vulnerable _before_ you apply the patch. After you install the patch you _will_still get the same message.
Current thread:
- Re: Alert: MS IIS 4 / IS 2 (Cerberus Security Advisory CISADV0001 26) Cave, Glynis (Jan 31)