Microsoft upgrades threat rating on server flaw - News - Security

To print: Select File and then Print from your browser's menu

--------------------------------------------------------------
This story was printed from ZDNet Australia.
--------------------------------------------------------------

Microsoft upgrades threat rating on server flaw

By Patrick Gray, 0
June 02, 2003
URL: http://www.zdnet.com.au/news/security/soa/Microsoft-upgrades-threat-rating-on-server-flaw/0,130061744,120274997,00.htm

Microsoft has been forced to upgrade its latest security advisory after a problem it originally classified as a Denial of Service (DoS) vulnerability was found to be much more serious by security researchers.

The advisory was originally released last Wednesday, and described the vulnerability that affected the Windows Media Services component of the Microsoft IIS Web-server as moderate.

It was re-released on Friday. It upgraded the threat rating to "Important".

"On May 28th, Microsoft released the initial version of this bulletin, rating the severity of the vulnerability as Moderate. Subsequent to that release we have determined that the actions an attacker could take as a result of exploiting this vulnerability could include the ability to execute arbitrary code," it said. "As a result, Microsoft has reissued this bulletin and changed the severity rating to Important".

Although the security advisory was updated, the original patch for the software remains unchanged.

"The original patch corrects the vulnerability and is not being re-released," the updated advisory says.

This came at a bad time for Microsoft, which was forced to pull a patch offline after it caused serious problems for Windows XP users who installed it.