Microsoft IIS MDAC RDS (msadcs.dll) Arbitrary Remote Command Execution

This script is Copyright (C) 2000-2017 Roelof Temmingh <[email protected]>

Synopsis :

The remote web server is affected by a remote command execution

Description :

The web server is probably susceptible to a common IIS vulnerability
discovered by 'Rain Forest Puppy'. This vulnerability enables an
attacker to execute arbitrary commands on the server with
Administrator Privileges.

*** Nessus solely relied on the presence of the file /msadc/msadcs.dll
*** so this might be a false positive

See also :;[LN];184375

Solution :

Upgrade to MDAC version 2.1 SP2 or higher, as it has been reported to
fix this vulnerability. It is also possible to correct the flaw by
implementing the following workaround: Delete the /msadc virtual
directory in IIS.

Risk factor :

Critical / CVSS Base Score : 10.0
CVSS Temporal Score : 9.5
Public Exploit Available : true

Family: Web Servers

Nessus Plugin ID: 10357 ()

Bugtraq ID: 529

CVE ID: CVE-1999-1011

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now