Description
A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original researcher is unreliable. Therefore the original disclosure is probably erroneous
References
- 20080924 Internet Information Service remote set password mailing-list
- 20081002 Fwd: Internet Information Service remote set password mailing-list
- iis-iisext-weak-security(45587) vdb-entry