The company that discovered a security hole in Windows 2000 has warned that hackers have written a program to take advantage of the hole and posted the program to the Internet. However, third-party hackers later developed their own version of the exploit, and publicized their program across the Internet. Microsoft this week urged Windows 2000 users to install a software patch that plugs a security hole that could allow hackers to take control of their systems. The bug affects users who have Internet Information Server 5.0 running with Internet printing turned on, which is the default configuration.
Hackers can send the server a string that causes a buffer overflow.
This allows the hackers to run any program they want on the server. The flaw is serious because it's easy to exploit. It gives hackers complete control of the server. However, the security hole can be easily fixed. The Internet printing feature of IIS is designed to allow users to run print jobs remotely.