Hi - I just read about this security issue with IIS ... http://www.microsoft.com/technet/security/advisory/975191.mspx It says ftp service 7.5 is not vulnerable. How do I know what version is running? Thanks!
That depends on what server you are on. Most (all?) IIS 7 servers are running FTP 7.5. I don't think the server broadcasts the version number, so it wouldn't be in your FTP log. As soon as they release a fix for this on IIS 6 we will implement it.
Just to confirm, all of our systems that are running Windows Server 2008 are using Microsoft FTP Service version 7.5 that we deployed a few months back on April 1, 2009. Also, we do not allow anonymous FTP connections on either Windows Server 2003 or 2008 and direct write permissions to the FTP root directory is not enabled which satisfies the suggestions that were made under the workarounds listed under the security advisory.
We have gotten confirmation from our IPS vendor (tipping point) last wk that they have updated the filter to block off this attack.
