Windows 2000 Exploits Published and Generalised
27th March, 2003
Further to our article on the widespread availability of WebDAV on Microsoft-IIS/5.0 sites, Roman Medina and Rafael Nunez have each published the sources to programs written to exploit the vulnerability.
Additionally, David Litchfield has produced a paper emphasizing that the problem is a core DLL in Windows 2000 that is possible to exploit without recourse to the published Microsoft-IIS WebDAV vulnerability.
Expert opinion is that no unpatched Windows 2000 machines are safe.
Netcraft's network exploration services may be useful for people managing large networks of Windows 2000 servers. In particular, we can report machines not yet rebooted since the availability of Microsoft's patch and determine availability of WebDAV functionality on those machines.
Please mail us if interested.
March 2003 Web Server Survey
25th March, 2003
In the March 2003 survey we received responses from 39,174,349 sites.
Market Share for Top Servers Across All Domains August 1995 - March 2003
Top Developers
| Developer | February 2003 | Percent | March 2003 | Percent | Change |
|---|---|---|---|---|---|
| Apache | 22492327 | 62.72 | 244 86857 | 62.51 | -0.21 |
| Microsoft | 9687454 | 27.01 | 1 0748795 | 27.44 | 0.43 |
| Zeus | 768951 | 2.14 | 794940 | 2.03 | -0.11 |
| SunONE | 428004 | 1.19 | 419120 | 1.07 | -0.12 |
Windows 2000 passes the million mark
25th March, 2003
Windows 2000 goes past one million IP addresses for the first time this month. Including sites running NT4 and Windows 2003, there are slightly over 1.5 million internet web sites running a Microsoft operating system.
Three quarters of Microsoft-IIS sites have WebDAV enabled
18th March, 2003
On 17th March Microsoft issued a security alert regarding a buffer overflow vulnerability which allows attackers to execute arbitrary code on Windows 2000 machines. The vulnerability is triggered by the Microsoft-IIS/5.0 implementation of the World Wide Web Distributed Authoring and Versioning (WebDAV) protocol and is specific to Microsoft-IIS/5.0 - WebDAV was not supported in Microsoft-IIS/4.0, and Microsoft-IIS/6.0 is reported to be unaffected.
Microsoft-IIS/5.0 runs about 9 million web sites on just over 1 million ip addresses, making it the most widely deployed web server that has WebDAV enabled by default. Many sites disable WebDAV: best practice dictates that features that are not used should be disabled, and the IIS Lockdown tool recommended by Microsoft can disable WebDAV. However, although the number of sites that have disabled WebDAV is significant, our own data indicates that around three quarters of Microsoft-IIS/5.0 servers have WebDAV enabled, implying that at the time of announcement there were over 6 million vulnerable web sites.
The actual vulnerability occurs in a system DLL called by the WebDAV component, not in the WebDAV support itself. There may be ways to exploit this vulnerability via other components, or even other products. There is believed to be an exploit already in the wild for this vulnerability, and Windows 2000 administrators should apply the patch as soon as possible. CERT have issued an advisory (CA-2003-09), and Microsoft have issued a patch (see bulletin MS03-007).
The patch requires a reboot to become effective, and we have noticed that over half of the Microsoft-IIS/5.0 servers on the internet were rebooted during a two day period after the annoucement. The number of sites rebooting sets a lower bound on the uptake of the patch [a reboot is necessary as part of the patch installation] but will overstate the number of patched systems, as some sites will have rebooted for other reasons.
February 2003 Web Server Survey
25th February, 2003
In the February 2003 survey we received responses from 35,863,952 sites.
Market Share for Top Servers Across All Domains August 1995 - February 2003
Top Developers
| Developer | January 2003 | Percent | February 2003 | Percent | Change |
|---|---|---|---|---|---|
| Apache | 22,045,420 | 62.23 | 22,492,327 | 62.72 | 0.49 |
| Microsoft | 9,739,590 | 27.49 | 9,687,454 | 27.01 | -0.48 |
| Zeus | 736,744 | 2.08 | 768,951 | 2.14 | 0.06 |
| SunONE | 471,942 | 1.33 | 428,004 | 1.19 | -0.14 |
Apache on Windows Struggling?
25th February, 2003
One of the goals of Apache/2.0 was to better support operating systems other than Unix. While the Windows version of Apache/1.3 was advertised as experimental, it was hoped that in Apache/2.0 it would become much more widely established. However, since the first general release of Apache/2.0 there have been a string of security problems in the Windows (and other non-Unix) versions that may undermine confidence in the suitability of Apache for these platforms.
Windows Apache entries listed at mitre.org's common vulnerabilities database include directory traversal using dot-dot paths, revealing script source by appending invalid characters, and DOS device names causing a denial-of-service. The striking thing is that these are sterotypical vulnerabilities that over the years many other products have suffered from, and fixed. Apache developers will be disappointed that they were not able to learn from other people's mistakes sufficiently well to pre-empt the same vulnerabilities appearing in their own server.
In the current month's survey we find over 16,000 Apache Win32 sites on the 'Web which may be vulnerable to one of these problems.
Notwithstanding the security problems, the support for threading in Apache/2.0 is a major performance breakthrough for the Windows version and consquently sites using Apache on Windows have a bigger incentive to upgrade to version 2 than sites on Unix. This is reflected in the relative uptake of Apache/2.0: a little over 1% of all Apache sites are running version 2, but amongst Windows servers the proportion is over 7%.