Microsoft's IIS 6 Web-server software admits hackers to servers

It was announced that the vulnerability of Microsoft's Internet Information Services 6 Web-server software that was posted to the Full Disclosure security mailing list by a security researcher Nikolaos Rangos, was being used for online attacks. 

IIS 6 users who have enabled the WebDAV (Web-based Distributed Authoring and Versioning) protocols, used to share documents via the Web were forecasted to be subject to attacks. The attackers using the vulnerability are able to view protected files on the server without authorization. Moreover, they can upload files, states Thierry Zoller, an independent security researcher. 

However, Zoller had found no way to use this flaw to run unauthorized software on an IIS the vulnerability could affect other Microsoft products that use the WebDAV technology. He recommends the users to "Disable WebDAV temporarily and wait for Microsoft to patch."

It is also known that Cisco had warned administrators "to put effective mitigations into place immediately because exploit code is publicly available." 

Microsoft said it was not aware of such attacks.