Attack program threatens nearly 6 million Web sites worldwide.

July 7, 2001

A hacking script that gives remote attackers complete control of vulnerable computers running Microsoft's popular Web-server software has been posted on the Geocities home page of a Japanese hacker. The source code exploits a recently discovered bug in Microsoft's Internet Information Server (IIS) and may have been in use for nearly two weeks. According to the code, it was created on June 21.

The malicious code was released just 3 days after warning message from Microsoft that its ISS software contains a buffer overflow that could enable a remote intruder to gain full control of the server.

Last week an anonymous third party posted a link to the attack program on Win2KSecAdvice mailing list. It noted that the source script is already listed on at least one hacking site that offers hacking tools.

Microsoft was unavailable for comment at the time.