nerdexam
GIAC

GCIH · Question #252

John works as a professional Ethical Hacker. He has been assigned the project of testing the attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing…

The correct answer is A. IIS buffer overflow. Removing the IPP (Internet Printing Protocol) capability from IIS is a specific countermeasure against IIS buffer overflow attacks, as the IPP component was a known vulnerable attack surface in early IIS versions.

Vulnerability Exploitation & Privilege Escalation

Question

John works as a professional Ethical Hacker. He has been assigned the project of testing the attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing capability from the server. He is suggesting this as a countermeasure against __________.

Options

  • AIIS buffer overflow
  • BNetBIOS NULL session
  • CSNMP enumeration
  • DDNS zone transfer

How the community answered

(23 responses)
  • A
    83% (19)
  • B
    4% (1)
  • C
    4% (1)
  • D
    9% (2)

Why each option

Removing the IPP (Internet Printing Protocol) capability from IIS is a specific countermeasure against IIS buffer overflow attacks, as the IPP component was a known vulnerable attack surface in early IIS versions.

AIIS buffer overflowCorrect

Early versions of Microsoft IIS included an Internet Printing Protocol (IPP) component that contained buffer overflow vulnerabilities; attackers could send malformed HTTP requests to the printer URL path to overflow a buffer and execute arbitrary code, so disabling IPP directly mitigates this specific attack vector.

BNetBIOS NULL session

NetBIOS NULL session attacks exploit unauthenticated SMB/NetBIOS sessions to enumerate users and shares, and are countered by restricting anonymous access to the registry and NetBIOS, not by removing IPP.

CSNMP enumeration

SNMP enumeration attacks exploit weak community strings on the SNMP service to gather network information, and are mitigated by disabling SNMP or enforcing strong community strings, not by removing IPP.

DDNS zone transfer

DNS zone transfer attacks exploit misconfigured DNS servers that allow unauthorized AXFR queries, and are countered by restricting zone transfers to authorized secondary servers, not by removing IPP.

Concept tested: IIS IPP buffer overflow countermeasure

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-023

Topics

#IIS buffer overflow#IPP printing#web server hardening#countermeasures

Community Discussion

No community discussion yet for this question.

Full GCIH Practice