GEN:SID | 1:1039 |
Message | WEB-IIS srch.htm access |
Summary | This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS).
|
Impact | Information gathering possible administrator access.
|
Detailed Information | This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS.
The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information.
This event is generated when an attempt is made to access a sample application on a Microsoft IIS server. In this case the sample search functionality. This application may present an attacker with the opportunity to gain valuable information regarding the implemenation of IIS on the affected host.
|
Affected Systems | Any host using IIS.
|
Attack Scenarios | An attacker can retrieve a sensitive file containing information on the IIS implementation. The attacker might then gain administrator access to the site, deface the content or gain access to a database.
|
Ease of Attack | Simple.
|
Corrective Action | Check the IIS implementation on the host. Ensure all measures have been taken to deny access to sensitive files.
Ensure that the IIS implementation is fully patched.
Ensure that the underlying operating system is fully patched.
Employ strategies to harden the IIS implementation and operating system.
Check the host for signs of compromise.
Delete or disable access to any sample applications on the host.
|
Additional References | Microsoft: http://support.microsoft.com/support/kb/articles/Q188/2/57.ASP&NoWebContent=1
|