You will still be vulnerable to the DoS in any case.ĬVE-2009-3023 (RCE on IIS 5.0 and DoS on IIS 5.1 and IIS 6.0)ĬVE-2009-2521 (DoS on IIS 5.0, IIS 5.1, IIS 6.0, and IIS 7. They are either done against public services (such as HTTP and FTP) or during the logon of protected services (such as POP and IMAP). Key point: The most common remote exploits are buffer overflow and other unchecked input attacks. If you must allow write access, disable creation of directories. A local exploit may be needed in order to break out of the sandbox. If you must allow anonymous access, modify the NTFS permissions to disable write access. If you must allow FTP, disable anonymous access. The DoS takes out all inetinfo processes, including The exploit code is available. and then DoS can still occur, but complete compromise of the system will not. Unless the attacker is able to obtain a valid username for the system and modify the exploit. One mitigation is to NOT allow anonymous connections (as indicated in the POC circulating on the Internet). For internal instances I might monitor them very closely. If you are still running an Internet accessible FTP service you may want to take this opportunity to rethink running it under IIS.

On more recent versions a DoS condition occurs.

At this time arbitrary remote code execution only works against IIS 5.0 running on Windows 2000 fully patched. FTP Server then initiates the data connection. Microsoft has published an advisory on multiple vulnerabilities in the Microsoft FTP services bundled with IIS 5.0, IIS 5.1, IIS 6.0 or IIS 7.0. The client then listens to port N+1 and sends the port N+1 to FTP Server.

Microsoft ftp service exploit