Just exactly HOW vulnerable is IIS now?

[Fat Tone]

How bad is it these days, even if well patched and up-to-date? The thought of running IIS on a Win2k server seems to give a few people palpitations - especially the network support guys at my place!

If it really still is the devils spawn from a security point of view, are there any favourites for running web & FTP under Win2k Server, preferably free?

TIA

T.

[Gurm]

If well patched and up-to-date? Pretty secure.

All these vulnerabilities and attacks have been because admins refuse to apply new patches.

Sorry folks, but the "wait for SP1" mentality doesn't apply to security fixes. You apply 'em RIGHT AWAY.

- Gurm

[Wombat]

Actually, a little tidbit I found out:

Slammer was fixed by a patch released by MS in July.
Another patch released by MS in October opened the vulnerability again!

[LvR]

Have not seen the Oct thing anywhere yet.......have you got a link to an article somewhere

[Ribbit]

Originally posted by Wombat
Actually, a little tidbit I found out:

Slammer was fixed by a patch released by MS in July.
Another patch released by MS in October opened the vulnerability again!

Haven't these people heard of regression testing?

@Tony: Apache's supposed to be pretty popular under Windows. (I think.)

[Gurm]

I haven't heard that it was reopened... but I know it WAS fixed last July.

- Gurm

[Wombat]

I can't find anything reasonable to support my source, so consider it retracted for now.

[yjanni]

Apache 1.3xxxxx

[alekz]

I'm running Apache 2, PHP4.x, ActiveState Perl and MySQL on a Windows XP SP1 box and it works great! The built-in IIS5.1 has a limit on the number of allowed connections so it's no good unless you're running a really small server unless you get a server variant of Windows.