How secure is IIS7.5 with Windows 2008 R2 web server?

Question

Very theoretical question, how secure is the mentioned configuration? (IIS7.5 and Windows 2008 R2). I don't mean things like easy passwords, open ports and unsecured c#/.net code.

I mean, are there any serious holes/hacks which ignore any user settings and that attacker is able to gain access to server?

Is it much more secure than IIS6 and Windows Server 2003 used to be? Would you put it online without putting firewall before it? (update: I mean linux/unix/hw firewall in front of windows machine. Windows firewall has to be always on)

Answer 1

There are no known IIS 7.5 exploits, AFAIK. Microsoft patches remote code execution holes pretty fast nowadays. That being said, I would never put anything that you care about on the internet without a firewall, that's just bad. Even the built-in Windows Firewall is a big step forward from the 2003 firewall.

Just because there are no well-known exploits doesn't mean that 1) there won't be one tomorrow and 2)that you can ignore security best practices.