One vulnerability in 4.5 years compared to God know how many in IIS, and all the Microsofties come out of the woodwork.. If ISS had handled this incident the way they'd handle any Microsoft one, there wouldn't have been any problem. Instead, the dolts write a patch that doesn't work for many/most people, and then announce the problem to the world about six hours after alerting Apache. IIS's conduct seems to be the main source of alarm - not the bug. To be honest, I'd say their actions are completely indefensibe. But yes, the Microsofties will smile over this one. Does Microsoft have a strategic alliance with ISS?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/91/13359#13359