The eEye Digital Security Team has implemented a patch for Microsoft's Internet Information Server (IIS), closing the security hole for which eEye previously posted a controversial exploit.

While the patch may not fix all possible security problems in the Microsoft code, it guards against exploitation of the bug, allows users with expiring passwords to change them passwords via the Web, and logs attempts to break into the server via the known security hole.

Nearly every NT server vulnerable
Nearly every Windows NT-based Web server on the Internet is vulnerable to a newly discovered security hole that lets a malicious hacker take over the server -- and, in some cases, the network to which it is attached, says a network security company.

According to the eEye Digital Security Team, which develops network security software, it discovered the bug on June 6 when its Retina network security scanning software -- which automatically employs techniques commonly used to break into computer systems -- succeeded in crashing an NT server.

The engineers quickly realized that the bug could be exploited not only to crash the NT machine but also to take it over completely.

According to eEye CEO Firas Bushnaq, the company supplied detailed information about the bug to Microsoft Corp.  on June 8. However, a week later, said Bushnaq, the software giant had still not published a fix and stopped responding to e-mail correspondence about the bug.

eEye released break-in code
Believing that Microsoft "was not giving the problem the attention it deserved," eEye released not only a description of the hole but two working demonstration programs that allow anyone to break into an NT server running IIS 4.0. The break-in code appears to work on any server from which a Web page can be retrieved, even if a firewall is present.

eEye explained its decision to disclose the bug, and to publish a program that lets anyone readily exploit it, in a brief note on its Web site.

"We are a full-disclosure security team," they wrote. "If our team starts hiding the facts, we'll be no better than a software vendor that rushes insecure products to market."

Microsoft not impressed
Microsoft, however, took exception to this philosophy.

"Responsible security companies do not provide tools that can be used to attack innocent people," said Microsoft security manager Scott Culp.

'Responsible security companies do not provide tools that can be used to attack innocent people.' -- Microsoft security manager Scott Culp

Bushnaq, for his part, noted that a moderately skilled hacker, armed with the knowledge that the bug existed, could easily craft a program to exploit it in less than two hours.

Users who upload pages to the NT Web server cannot employ a Web-based mechanism to change their expiring passwords, and thus may be left without access.

WinNT: Tough to secure
This security glitch is one of many that have plagued Windows NT and IIS. Microsoft advises customers that a long list of steps, posted at its

site, should be taken whenever an NT/IIS machine is placed on the Net as a Web server.

These steps include disabling many NT features, such as POSIX compatibility, and in some cases reformatting the machine's hard drives.

The issue over which the two sides are at odds is C2 certification of NT. C2 is a basic security rating that is one of several evaluations awarded by the National Security Agency (NSA), based on its Trusted Computer System Evaluation Criteria (TCSEC), or "Orange Book" criteria.

Both Microsoft  and Curry agree on a few key facts. In the mid-1990s, Curry was working closely with Microsoft to obtain the company's NCSC/NSA C2 evaluation of NT 3.5 with Service Pack 3. As part of that effort, Curry developed a set of hardware security diagnostics for NT and wrote a C2 Rating Maintenance Phase (RAMP) program on behalf of Microsoft.

From this point, Curry's and Microsoft's respective accounts diverge on what happened next.

SAIC to take over certification efforts
In 1995, Microsoft ended Curry's contract for reasons that "we can't divulge due to our lawyers' recommendations," according to a Microsoft spokesperson. Microsoft last year hired Science Applications International Corp. (SAIC) to continue its NT C2 certification efforts. An SAIC official says a networked NT 4.0 configuration could pass its first C2 milestone within a few weeks.

To date, Microsoft has not obtained C2 certification for any release of NT beyond version 3.5, the company acknowledges.

Curry, meanwhile, says he was forced out of business when Microsoft ceased working with him. In recent months, Curry stepped up his campaign to alert the government and the public in general about "the government's procurement of millions of copies of non-evaluated versions of Windows NT that fail to meet the C2-level security requirements of the Department of Defense and other agencies."

Curry wouldn't lie about MS violations
Curry has an Oct. 13 meeting slated with the Secretary of Defense staff. The meeting is in response to a letter that Curry sent to Defense Secretary William Cohen, alerting him to potential security violations involving Windows NT. In the letter, Curry says his C2 certification contract was discontinued by Microsoft because he refused to lie about Microsoft's violations of C2 guidelines.

"Microsoft has knowingly and willfully concealed information regarding security flaws in computer hardware from the NSA out of fear that revealing such flaws would reduce the number of copies of its products that would be purchased by the government," Curry's letter to Cohen says. "I have raised this issue internally with Microsoft, and in return have been the subject of both bribes and threats."

The hole was discovered by L0pht Heavy Industries, a hacker group and security-consulting firm. Right now, L0pht, which posted details about the hole on its Web site.

'You could get elevated access.' -- Karan Khanna, Microsoft

According to L0pht, the opening could allow a local user to take control of a network.

Microsoft said it will issue a bulletin to system administrators.

From user to 'superuser'
The problem arises when a network administrator uses one of the default security settings instead of altering it to provide tighter protection. Under the default setting, any user in the network potentially could replace commonly used files with their own versions. As a result, that person can obtain privileges they shouldn't have access to, essentially becoming an administrator or "superuser."