MS11-004: Vulnerability in Internet Information Services (IIS) FTP service could allow remote code execution

Microsoft has released security bulletin MS11-004. To view the complete security bulletin, visit one of the following Microsoft websites:

• Home users:
  http://www.microsoft.com/security/pc-security/bulletins/201102.aspx (http://www.microsoft.com/security/pc-security/bulletins/201102.aspx)
  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update website now:
  http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/MS11-004.mspx (http://www.microsoft.com/technet/security/bulletin/MS11-004.mspx)

How to obtain help and support for this security update

Help installing updates: Support for Microsoft Update (http://support.microsoft.com/ph/6527)

Security solutions for IT professionals: TechNet Security Troubleshooting and Support (http://technet.microsoft.com/security/bb980617.aspx)

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center (http://support.microsoft.com/contactus/cu_sc_virsec_master)

Local support according to your country: International Support (http://support.microsoft.com/common/international.aspx)

You may be unable to uninstall this security update on a Server Core installation of Windows Server 2008 if the version of FTP 7.0 or FTP 7.5 is installed from the Microsoft Download Center. To uninstall the update in this scenario, you must temporarily uninstall FTP 7.0 or FTP 7.5 entirely, and then reinstall FTP 7.5. When you do this, the security update is also removed.

Notes

• We do not recommend that you uninstall any security update. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
• Your FTP server configuration will not be lost when you uninstall FTP 7.0 or FTP 7.5 entirely and then reinstall FTP 7.5.
• FTP 7.0 is no longer available for download. When you use this workaround, you must reinstall FTP 7.5. We are not aware of compatibility issues between FTP 7.0 and FTP 7.5.

To uninstall FTP 7.0 or FTP 7.5, follow these steps:

1. Type the following command at command prompt to identify the PackageCode for the FTP version that you have installed:
   wmic product
   For convenience, you can type the following command to create a notepad text file that lists the installed programs on the system:
   wmic product > C:\path\list.txt
2. After you identify the PackageCode for the FTP version that you have installed, type the following command from an elevated command prompt to uninstall the FTP 7.0 or FTP 7.5 program:
   msiexec /uninstall {ProductID}
   For example, depending on the FTP version that you have installed, the command that you type may resemble either of the following:
   
   FTP 7.0
   msiexec.exe /uninstall {15ABFD45-B97E-483D-A6C9-28AA751A1C01}
   FTP 7.5
   msiexec.exe /uninstall {790AE609-3122-4C3E-9EA8-687F7B00ED0E}

Information about the security update for IIS FTP 7.5 for Windows Vista and Windows Server 2008

In some scenarios, you may have to install an earlier version of IIS FTP 7.5 for Windows Vista. We are providing versions 7.5.7055 and 7.5.7600 on the Microsoft Download Center. The following files are available for download from the Microsoft Download Center:

Security Update for IIS FTP 7.5.7055 for x86-based versions of Windows Vista (KB2489256)

Download the ftp75_en_x86_kb2489256.msp package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=c2fb0157-e019-47ac-af80-79217e01f24d)

Security Update for IIS FTP 7.5.7055 for x64-based versions of Windows Vista (KB2489256)

Download the ftp75_en_x64_kb2489256.msp package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=ef04be0d-3628-4487-aa16-ab0fa814679f)

Security Update for IIS FTP 7.5.7055 for x86-based versions of Windows Server 2008 (KB2489256)

Download the ftp75_en_x86_kb2489256.msp package now. (http://www.microsoft.com/download/en/details.aspx?id=19864)

Security Update for IIS FTP 7.5.7055 for x64-based versions of Windows Server 2008 (KB2489256)

Download the ftp75_en_x64_kb2489256.msp package now. (http://www.microsoft.com/download/en/details.aspx?id=14034)

Security Update for IIS FTP 7.5.7600 for x86-based versions of Windows Server 2008 (KB2489256)

Download the ftp75_x86_kb2489256.msp package now. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=4dfa0a25-b7e3-4fb6-a351-58ec3f8a8435)

Security Update for IIS FTP 7.5.7600 for x86-based versions of Windows Vista (KB2489256)

Download the ftp75_x86_kb2489256.msp package now. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=da9b7982-1c6b-45ac-8dd0-d7101bb83949)

Security Update for IIS FTP 7.5.7600 for x64-based versions of Windows Server 2008 (KB2489256)

Download the ftp75_x64_kb2489256.msp package now. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=a98a74c1-0c91-446d-b822-fe57ff06d90b)

Security Update for IIS FTP 7.5.7600 for x64-based versions of Windows Vista (KB2489256)

Download the ftp75_x64_kb2489256.msp package now. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6e4b9878-b5d2-4025-8839-b41515932cf2)

Release Date: April 12, 2011

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Installation instructions

To determine the correct security update to install in your environment, follow these steps:

1. Open the %system32%\inetsrv folder, right-click the Ftpsvc.dll file, and then click Properties.
   
   On a 34-bit x86-based system:
   • Install ftp75_en_x86_kb2489256.msp if the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14307 and 7.5.7055.14310.
   • Install ftp75_x86_kb2489256.msp of the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14445 and 7.5.7600.14978.
   On a 64-bit system:
   • Install ftp75_en_x64_kb2489256.msp if the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14307 and 7.5.7055.14310.
   • Install ftp75_x64_kb2489256.msp of the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14445 and 7.5.7600.14978.
2. Based on the previous step, visit the Download Center page that corresponds to the version that you need. Click Download, and then do one of the following:
   1. Click Run to start the installation immediately.
   2. Click Save to copy the download to your computer for installation at a later time.

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Windows Vista and Windows Server 2008 file information

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000. 16xxx	Windows Vista	RTM	GDR
  6.0.6000. 20xxx	Windows Vista	RTM	LDR
  6.0.6001. 18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001. 22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR
  6.0.6002. 18xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	GDR
  6.0.6002. 22xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

IIS FTP 7.5.7600 for Windows Vista and Windows Server 2008

For all supported x64-based versions of Windows Vista and of Windows Server 2008 with FTP 7.5 installed

For all supported x86-based versions of Windows Vista and of Windows Server 2008 with FTP 7.5 installed

IIS FTP 7.5.7055 for Windows Vista and Windows Server 2008

For all supported x86-based versions of Windows Vista with FTP 7.5 installed

For all supported x64-based versions of Windows Vista with FTP 7.5 installed

IIS FTP 7.0 for Windows Vista and Windows Server 2008

For all supported x64-based versions of Windows Vista and of Windows Server 2008 with FTP 7.0 installed

For all supported x86-based versions of Windows Vista and of Windows Server 2008 with FTP 7.0 installed

Windows 7 and Windows Server 2008 R2 file information

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.1.7600. 16xxx	Windows 7 and Windows Server 2008 R2	RTM	GDR
  6.1.7600. 20xxx	Windows 7 and Windows Server 2008 R2	RTM	LDR
  6.1.7600. 17xxx	Windows 7 and Windows Server 2008 R2	SP1	GDR
  6.1.7600. 21xxx	Windows 7 and Windows Server 2008 R2	SP1	LDR

• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows 7 and Windows Server 2008 R2" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows 7

For all supported x64-based versions of Windows 7 and of Windows Server 2008 R2

For all supported IA-64-based versions of Windows Server 2008 R2

Additional file information for Windows 7 and Windows Server 2008 R2

Additional files for all supported x86-based versions of Windows 7

Additional files for all supported x64-based versions of Windows 7 and of Windows Server 2008 R2

Additional files for all supported IA-64-based versions of Windows Server 2008 R2