MS11-004: Vulnerability in Internet Information Services (IIS) FTP service could allow remote code execution

INTRODUCTION

Microsoft has released security bulletin MS11-004. To view the complete security bulletin, visit one of the following Microsoft websites:

Home users:

http://www.microsoft.com/security/pc-security/bulletins/201102.aspxSkip the details: Download the updates for your home computer or laptop from the Microsoft Update website now:

http://update.microsoft.com/microsoftupdate/
IT professionals:

http://www.microsoft.com/technet/security/bulletin/MS11-004.mspx

How to obtain help and support for this security update

Help installing updates: Support for Microsoft UpdateSecurity solutions for IT professionals: TechNet Security Troubleshooting and SupportHelp protect your computer that is running Windows from viruses and malware:Virus Solution and Security CenterLocal support according to your country: International Support

Known Issues

You may be unable to uninstall this security update on a Server Core installation of Windows Server 2008 if the version of FTP 7.0 or FTP 7.5 is installed from the Microsoft Download Center. To uninstall the update in this scenario, you must temporarily uninstall FTP 7.0 or FTP 7.5 entirely, and then reinstall FTP 7.5. When you do this, the security update is also removed. Notes

We do not recommend that you uninstall any security update. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
Your FTP server configuration will not be lost when you uninstall FTP 7.0 or FTP 7.5 entirely and then reinstall FTP 7.5.
FTP 7.0 is no longer available for download. When you use this workaround, you must reinstall FTP 7.5. We are not aware of compatibility issues between FTP 7.0 and FTP 7.5.

To uninstall FTP 7.0 or FTP 7.5, follow these steps:

Type the following command at command prompt to identify the PackageCode for the FTP version that you have installed:

wmic productFor convenience, you can type the following command to create a notepad text file that lists the installed programs on the system:

wmic product > C:\path\list.txt
After you identify the PackageCode for the FTP version that you have installed, type the following command from an elevated command prompt to uninstall the FTP 7.0 or FTP 7.5 program:

msiexec /uninstall {ProductID}For example, depending on the FTP version that you have installed, the command that you type may resemble either of the following: FTP 7.0

msiexec.exe /uninstall {15ABFD45-B97E-483D-A6C9-28AA751A1C01}FTP 7.5

msiexec.exe /uninstall {790AE609-3122-4C3E-9EA8-687F7B00ED0E}

Information about the security update for IIS FTP 7.5 for Windows Vista and Windows Server 2008

In some scenarios, you may have to install an earlier version of IIS FTP 7.5 for Windows Vista. We are providing versions 7.5.7055.14307 and 7.5.7056.14445 on the Microsoft Download Center. The following files are available for download from the Microsoft Download Center:

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7055.14307 for x86-based versions of Windows Vista (KB2489256)

Download Download the ftp75_en_x86_kb2489256.msp package now.

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7055.14307 for x64-based versions of Windows Vista (KB2489256)

Download Download the ftp75_en_x64_kb2489256.msp package now.

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7055.14307 for x86-based versions of Windows Server 2008 (KB2489256)

Download Download the ftp75_en_x86_kb2489256.msp package now.

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7055.14307 for x64-based versions of Windows Server 2008 (KB2489256)

Download Download the ftp75_en_x64_kb2489256.msp package now.

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7056.14445 for x86-based versions of Windows Server 2008 (KB2489256)

Download Download the ftp75_x86_kb2489256.msp package now.

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7056.14445 for x86-based versions of Windows Vista (KB2489256)

Download Download the ftp75_x86_kb2489256.msp package now.

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7056.14445 for x64-based versions of Windows Server 2008 (KB2489256)

Download Download the ftp75_x64_kb2489256.msp package now.

Security Update for FTP Service 7.5 for IIS 7.0 version 7.5.7056.14445 for x64-based versions of Windows Vista (KB2489256)

Download Download the ftp75_x64_kb2489256.msp package now. Release Date: April 12, 2011For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online servicesMicrosoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Installation instructions

To determine the correct security update to install in your environment, follow these steps:

Open the %system32%\inetsrv folder, right-click the Ftpsvc.dll file, and then click Properties. On a 34-bit x86-based system:
- Install ftp75_en_x86_kb2489256.msp if the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14307 and 7.5.7055.14310.
- Install ftp75_x86_kb2489256.msp of the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14445 and 7.5.7600.14978.
On a 64-bit system:
- Install ftp75_en_x64_kb2489256.msp if the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14307 and 7.5.7055.14310.
- Install ftp75_x64_kb2489256.msp of the version of the Ftpsvc.dll file in the %system32%\inetsrv directory is between 7.5.7055.14445 and 7.5.7600.14978.
Based on the previous step, visit the Download Center page that corresponds to the version that you need. Click Download, and then do one of the following:
1. Click Run to start the installation immediately.
2. Click Save to copy the download to your computer for installation at a later time.

FILE INFORMATION

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Windows Vista and Windows Server 2008 file information

The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

Version	Product	Milestone	Service branch
6.0.6000. 16xxx	Windows Vista	RTM	GDR
6.0.6000. 20xxx	Windows Vista	RTM	LDR
6.0.6001. 18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
6.0.6001. 22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR
6.0.6002. 18xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	GDR
6.0.6002. 22xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	LDR

Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

FTP Service 7.5 for IIS 7.0 version 7.5.7056.14445 for Windows Vista and Windows Server 2008

For all supported x64-based versions of Windows Vista and of Windows Server 2008 with FTP 7.5 installed

File name	File version	File size	Date	Time	Platform
Ftpsvc.dll	7.5.7600.14978	419,592	07-Jan-2011	10:11	x64

For all supported x86-based versions of Windows Vista and of Windows Server 2008 with FTP 7.5 installed

File name	File version	File size	Date	Time	Platform
Ftpsvc.dll	7.5.7600.14978	332,040	07-Jan-2011	10:11	x86

FTP Service 7.5 for IIS 7.0 version 7.5.7055.14307 for Windows Vista and Windows Server 2008

For all supported x86-based versions of Windows Vista with FTP 7.5 installed

File name	File version	File size	Date	Time	Platform
Ftpsvc.dll	7.5.7055.14310	332,040	27-Jan-2011	23:49	x86

For all supported x64-based versions of Windows Vista with FTP 7.5 installed

File name	File version	File size	Date	Time	Platform
Ftpsvc.dll	7.5.7055.14310	419,592	27-Jan-2011	23:49	x64

IIS FTP 7.0 for Windows Vista and Windows Server 2008

For all supported x64-based versions of Windows Vista and of Windows Server 2008 with FTP 7.0 installed

File name	File version	File size	Date	Time	Platform
Ftpsvc.dll	7.0.6545.14979	413,448	07-Jan-2011	10:16	x64

For all supported x86-based versions of Windows Vista and of Windows Server 2008 with FTP 7.0 installed

File name	File version	File size	Date	Time	Platform
Ftpsvc.dll	7.0.6545.14979	328,456	07-Jan-2011	10:16	x86

Windows 7 and Windows Server 2008 R2 file information