Microsoft announced yesterday (1st September) the Security Advisory 975191 on a vulnerability in the service FTP (File Transfer Protocol) Internet Information Server 5.0, 5.1 and 6.0. This vulnerability allows an attacker to execute remote code with administrator permission on systems that are running these versions of the FTP service and where the attacker has write access.

The vulnerable versions of the FTP service are found in Windows 2000 Server, Windows XP and Windows Server 2003, and in the last two this service is not installed by default. In no case the FTP service is installed with anonymous users with write permission. Newer versions of Windows (Vista, Server 2008 and Windows 7 ) are not affected.

Microsoft is actively working on a fix for this vulnerability. While a fix is ​​not available if you use the FTP service in the versions mentioned you can protect yourself by adopting one of the following measures:

■ Disable the creation of new directories for the FTP service - The vulnerability is exploited by the attacker listing a folder name specially crafted FTP service, you can protect yourself and prevent the creation of new directories in the area used for this service using the NTFS permissions :

1. Go to the root folder of your FTP service (by default% systemroot% \ inetpub \ ftproot).
2. Right-click on the folder and select Properties.
3. Select the Security tab and click Advanced.
4. Click Change permissions.
5. Select each user group and click Edit.
6. Uncheck Create Folders / Append Data.

Note that ordinary users will no longer have permissions to create new folders using the FTP service, but still be able to write files in folders.

■ Do not allow writing files via FTP service - No writable FTP vulnerability can not be exploited. Anonymous users by default no longer have write permission, and you can remove permission for all users by editing the service properties as shown below:

■ Disable the FTP service - The FTP service is installed by default in Windows 2000 Server. If you do not need this service, you can disable it by following the steps in article 321141 .

Microsoft also recommends that all users keep their software antivirus active and updated, and if they use system for detecting and preventing network attacks that they update their software. For software snort rules to detect this attack are already available in http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2009-09-01.html .

More information about this vulnerability are available (in English) on the blogs of the Microsoft Security Response Center and the Microsoft Security Research and Defense .