nerdexam
GIAC

GPEN · Question #56

John works as a professional Ethical Hacker. He has been assigned the project of testing the attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing cap

The correct answer is D. IIS buffer overflow. The IPP (Internet Printing Protocol) ISAPI extension in IIS has historically been exploited via buffer overflow vulnerabilities, so removing it reduces that attack surface.

Exploitation & Post-Exploitation Techniques

Question

John works as a professional Ethical Hacker. He has been assigned the project of testing the attacks. As a countermeasure, he suggests that the Network Administrator should remove the IPP printing capability from the server. He is suggesting this as a countermeasure against __________.

Options

  • ASNMP enumeration
  • BNetBIOS NULL session
  • CDNS zone transfer
  • DIIS buffer overflow

How the community answered

(56 responses)
  • A
    7% (4)
  • B
    4% (2)
  • C
    18% (10)
  • D
    71% (40)

Why each option

The IPP (Internet Printing Protocol) ISAPI extension in IIS has historically been exploited via buffer overflow vulnerabilities, so removing it reduces that attack surface.

ASNMP enumeration

SNMP enumeration is countered by disabling SNMP services or restricting community strings, not by removing IPP printing from IIS.

BNetBIOS NULL session

NetBIOS NULL session attacks are mitigated by disabling anonymous access and restricting NetBIOS over TCP/IP, which is unrelated to the IPP service.

CDNS zone transfer

DNS zone transfer attacks are prevented by configuring DNS servers to restrict zone transfers to authorized secondaries, not by removing IIS printing components.

DIIS buffer overflowCorrect

Internet Printing Protocol support in IIS is implemented as an ISAPI extension that has been associated with buffer overflow vulnerabilities, most notably documented in Microsoft Security Bulletin MS01-023. A buffer overflow in the IPP component allows a remote attacker to execute arbitrary code on the IIS server. Removing the IPP printing capability eliminates this vulnerable component entirely, directly countering IIS buffer overflow attacks that target it.

Concept tested: IIS IPP buffer overflow attack surface reduction

Source: https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2001/ms01-023

Topics

#IIS buffer overflow#IPP printing#attack surface reduction#countermeasures

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice