Service of Microsoft Internet news discovers a serious and safe flaw

[north face shirtsdispatch of Sai Di net] discovery of a researcher has a safe flaw in the service of Microsoft Internet news of newest version, baleful code is implemented on the computer that can let aggressor serve in the Web that runs this technological process.

Say according to researcher Soroush Dalili, information of Internet of consist in of this safe flaw serves analytic acting colon or in the means of the file name of semicolon. A lot of Web application processes install the folder that includes executable file to refuse, be like active server webpage, the patulous name of these executable files is normally " .ASP " . Pass " ; .jpg " or the file with beneficial other expands the name adds a baleful file, aggressor c dog crates large best buy an bypass filter and possible deceit server runs this baleful software.

12 volt adaptor

Safe to this flaw still exists it seems that a few difference. Dalili says, this safe flaw affects the Internet news service of all version. Although he labels this safe flaw " very serious " the safe flaw of grade, but, safe flaw dogs company Secunia is its classification " not quite serious " safe flaw. This is this company safe flaw the 2nd class in 5 grade.

Dalili says, the influence of this safe flaw is absolutely tall, because aggressor is passed,be in " .asp " , " .cer " , " Asa " wait for executable file to expand a semicolon is used to be able to bypass the file expands at the back of the name a safeguard. As a result of this weak point that Internet information serves, a lot of Web use the attack that the process is carried easily on the file.

furniture light

Dalili introduced the case of this kind of attack. He says, if a website accepts JPG file to serve as the head portrait of the user only, the user is OK to the head that oneself hold on this server. Now, aggressor is OK go up to this server carry " Avatar.asp; .jpg " file dvd discovery channel . Web application process inte dog stairs rprets this file is file of a JPG. Accordingly, this file allows to go u the best se dog stairs for car lling dog crates largep carry this serve most popular selling dog stairs r. But, open this to go up when aggressor the file that hold when, internet news service thinks this file is an ASP file and try to use " Asp.d dog crates large ll " run this file.

scooby costume

Dalili says, accordingly, aggressor uses this kind of method to be able to go up to the server record case of a Web. The last share that the program holds to be able to control a file only on great majority regards his as patulous name. Through using this kind of method, their safeguard was bypassed.

If make,Secunia evaluates conclusion without what explain it is. But, the belt that this company confirms dvd discovery 3 to consist in of this safe flaw moves to use a patch completely in the machine of the operating system of Windows Server 2003 R2 SP2 that Microsoft Internet safety serves the 6th edition.

Microsoft spokesman says, microsoft researcher is launching investigation to this report. The attack that Microsoft still does not know to the safe flaw that reports in the light of this is the best selling dog stairs carried out at present.