Software Engineering Institute

The Microsoft IIS FTP Service allows users to establish connections using either local accounts or Windows domain accounts. Connections made using a domain account require a username of the form "domain\&#xser" to distinguish them from local accounts. The FTP Service contains an access control vulnerability that causes the server to search all trusted domains for a matching domain account when the "domain" portion of the username contains a certain wildcard value. Once a matching domain account is found, the user must provide a correct password to gain access.

This vulnerability requires the attacker to provide a correct password, so the most likely accounts to be targeted are those that contain a well-known username and default password. For example, if any of the domains trusted by the server contain an enabled Guest account with a default (null) password, the FTP Service will use that account to log the user in as "Domain\Guest".

This vulnerability allows remote users to log in using a domain account without fully specifying the domain. This may result in either unauthorized file transfer access or information leakage.

Apply a patch from your vendor

Microsoft has released a patch for this vulnerability; for further information, please consult the systems affected section below.

Disable IIS FTP Service

Sites that do not require the IIS FTP Service may disable it to prevent exploitation of this vulnerability.