What? Say 60 days from release into the public domain and we'll have our first major vulnerability reported. Probabaly less. The problem is illustrated by the author of this article. That is the vendor's equal inability to accept the fact that they simply cannot make secure products. It cannot by done. You can take a person with a terrible voice and train them for 100 years and they will never be a singer. As with the author of this article, he finds it necessary to dilute the seriousness of the issue by always pointing elsewhere..."look at Solaris....look at AT&T..." It is this self-defeating mindset which contributes to the insecure products produced by this vendor. For a more accurate interpretation of this "new" system look here:

http://www.infosecuritymag.com/2003/apr/cover.shtml

http://www.infosecuritymag.com/2003/apr/lockdown.shtml

"Microsoft made a major architectural change to IIS to improve its performance. The logic responsible for initial processing of HTTP requests was moved out of IIS, which runs in user mode, to a kernel-mode component called http.sys. Code runs faster in kernel mode. But this could also be disastrous if the code falls victim to a buffer overflow, since kernel mode operates at a much higher privilege level."

60 days and counting...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/157/19605#19605