8, but there’s no indication as to whether the company will have a fix ready that quickly. Microsoft’s next patch release is due Sept. Microsoft said that it was not aware of any attacks ongoing against IIS servers using the new vulnerability, but with the exploit code on the loose now, that may change quickly. The attacker can create the specially-named directory if FTP is configured to allow write access using Anonymous account or another account that is available to the attacker,” US-CERT said in its advisory. By issuing an FTP NLST (NAME LIST) command on a specially-named directory, an attacker may cause a stack buffer overflow. “The IIS FTP server fails to properly parse specially-crafted directory names. IIS 5 and 6 are vulnerable to the attack. However, allowing anonymous users to write to an FTP server isn’t recommended in any case. The exploit code for the IIS flaw was posted to the Milw0rm site on Monday, and US-CERT published an advisory on the vulnerability later in the day, recommending that administrators disable anonymous write access to vulnerable servers. Microsoft security officials said they are investigating the issue. The flaw mainly affects older versions of IIS, Microsoft’s Web server product, but the existence of a working exploit and the popularity of IIS make the vulnerability a serious concern. There is exploit code circulating for a newly discovered vulnerability in the FTP service of Microsoft IIS, a flaw which could enable an attacker to run his own code on a remote server. CVE-2009-3023 : Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka " IIS FTP Service RCE and DoS Vulnerability.

Microsoft ftp service exploit