PT-2009-4032 · Microsoft · Webdav+1
Steven M. Christey
·
Published
2009-06-10
·
Updated
2020-11-23
·
CVE-2009-1535
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Microsoft Internet Information Services (IIS) versions 5.1 through 6.0
Description:
The issue allows remote attackers to bypass protection mechanisms and access or modify files. This can be achieved by inserting a specific Unicode character at an arbitrary position in the URI. For example, inserting
%c0%af into a /protected/ initial pathname component can bypass password protection on the protected folder.Recommendations:
For Microsoft Internet Information Services (IIS) versions 5.1 through 6.0, consider disabling the WebDAV extension until a patch is available to prevent bypassing of URI-based protection mechanisms. Restrict access to sensitive folders and files to minimize the risk of exploitation. Avoid using the WebDAV extension for sensitive operations until the issue is resolved.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Internet Information Services
Webdav