PT-2009-6566 · Microsoft · Internet Information Services

Published 2009-12-29 · Updated 2017-08-17 · CVE-2009-4445

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Information Services (IIS) (affected versions not specified)

Description The issue allows remote attackers to create empty files with arbitrary extensions when used with unspecified third-party upload applications. This is achieved by using a filename containing an initial extension followed by a : (colon) and a safe extension. For example, uploading a .asp:.jpg file results in the creation of an empty .asp file. This is related to support for the NTFS Alternate Data Streams (ADS) filename syntax.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-4445

Affected Products

Internet Information Services

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-4445 · Security Note
• http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55308 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4445 · Note
• http://securitytracker.com/id?1023387 · Note