Potential security loopholes when using anonymous access in IIS 6

Question

I had no luck in googling information related on security loopholes when using anonymous access in IIS. So I'm going to throw the question out here...

Maybe it is a very common practice for using anonymous access in IIS 6, but what are the potential security loopholes? I know the obvious fact that allowing anyone to login to the system is already a potential security problem, but I'm trying to cover off some specific security loopholes e.g. hacking of the anonymous account, illegal access of files, unauthorize access to parts of the system (e.g. SharePoint related stuff), etc etc.

Thanks.

Answer 1

In IIS 6.0, the anonymous user is actually *IUSR_computername*, which is a valid Windows user that is a member of the Guests group.If that user account has appropriate rights, then the action (typically to read the file) is performed.

Your concern of hacking the anonymous account is baseless as the anonymous user is already using that account. With Anonymous access , you actually avoid the risk of password hacking (as you never ask for password) for other windows accounts, which I would say provides better security in this sense.

Possible security loopholes arise is when

• You assign different account other than *IUSR_computername* and that account has permissions to do the unintended operations( illegal access of files, unauthorize access to parts of the system ).

• IUSR_computername or anonymous account has write access permissions.

• IUSR_computername or anonymous account has execute permissions to all executables in Windows directories and subdirectories.

When using anonymous access with SharePoint, It is common that developers impersonate a high privileged account (in code)to perform some operations(add item to list, delete item) which may again be a security issue.