GCIH · Question #252
John works as a professional Ethical Hacker. He has been assigned the project of testing the attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing…
The correct answer is A. IIS buffer overflow. Removing the IPP (Internet Printing Protocol) capability from IIS is a specific countermeasure against IIS buffer overflow attacks, as the IPP component was a known vulnerable attack surface in early IIS versions.
Question
John works as a professional Ethical Hacker. He has been assigned the project of testing the attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing capability from the server. He is suggesting this as a countermeasure against __________.
Options
- AIIS buffer overflow
- BNetBIOS NULL session
- CSNMP enumeration
- DDNS zone transfer
How the community answered
(23 responses)- A83% (19)
- B4% (1)
- C4% (1)
- D9% (2)
Why each option
Removing the IPP (Internet Printing Protocol) capability from IIS is a specific countermeasure against IIS buffer overflow attacks, as the IPP component was a known vulnerable attack surface in early IIS versions.
Early versions of Microsoft IIS included an Internet Printing Protocol (IPP) component that contained buffer overflow vulnerabilities; attackers could send malformed HTTP requests to the printer URL path to overflow a buffer and execute arbitrary code, so disabling IPP directly mitigates this specific attack vector.
NetBIOS NULL session attacks exploit unauthenticated SMB/NetBIOS sessions to enumerate users and shares, and are countered by restricting anonymous access to the registry and NetBIOS, not by removing IPP.
SNMP enumeration attacks exploit weak community strings on the SNMP service to gather network information, and are mitigated by disabling SNMP or enforcing strong community strings, not by removing IPP.
DNS zone transfer attacks exploit misconfigured DNS servers that allow unauthorized AXFR queries, and are countered by restricting zone transfers to authorized secondary servers, not by removing IPP.
Concept tested: IIS IPP buffer overflow countermeasure
Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-023
Topics
Community Discussion
No community discussion yet for this question.