PT-2009-4032 · Microsoft · Webdav+1
Steven M. Christey
·
Publicado
2009-06-10
·
Atualizado
2020-11-23
·
CVE-2009-1535
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Microsoft Internet Information Services (IIS) versions 5.1 through 6.0
Description:
The issue allows remote attackers to bypass protection mechanisms and access or modify files. This can be achieved by inserting a specific Unicode character at an arbitrary position in the URI. For example, inserting
%c0%af into a /protected/ initial pathname component can bypass password protection on the protected folder.Recommendations:
For Microsoft Internet Information Services (IIS) versions 5.1 through 6.0, consider disabling the WebDAV extension until a patch is available to prevent bypassing of URI-based protection mechanisms. Restrict access to sensitive folders and files to minimize the risk of exploitation. Avoid using the WebDAV extension for sensitive operations until the issue is resolved.
Exploit
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Internet Information Services
Webdav