SpydersWorld

Microsoft Internet Information Server (IIS) FTP server NLST stack buffer overflow

Microsoft Security Advisory (975191) and Vulnerability Note VU#276653

While there are no patches yet and likely none for the next patch Tuesday to fix this flaw, there are some things you can do to decrease the likelihood of being exploited.  The first and most important thing you can do is disable anonymous FTP.  For servers that allow anonymous file uploads, the attacker would typically be unauthenticated and thus unrestricted.  You should also prevent creation of new directories using NTFS ACLs and you should also prevent anonymous users from writing via IIS settings.  To detect the attacks you can find snort rules available already at http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2009-09-01.html.

The exploit, discovered by Kingcope, is in the wild currently and is available at milw0rm.