MS10-040: Vulnerability in Internet Information Services Could Allow Remote Code Execution (982666)
High Nessus Plugin ID 46847
SynopsisThe remote web server may allow remote code execution.
DescriptionA remote code execution vulnerability exists in Internet Information Services (IIS). The vulnerability, which requires that the Extended Protection for Authentication feature be installed and enabled, is due to improper parsing of authentication information. An attacker who successfully exploited this vulnerability could execute code in the context of the Worker Process Identity (WPI).
SolutionMicrosoft has released a set of patches for Windows 2003, Vista, 2008, 2008 R2 and 7.