Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Microsoft IIS File Parsing Extension Vulnerability - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Microsoft IIS File Parsing Extension Vulnerability

A vulnerability has been identified in Microsoft Internet Information Services (IIS) where the server in incorrectly handling files with multiple extensions separated by the ";" character such as "malicious.asp;.jpg" as an ASP file. This could allow attackers to upload malicious executables on a vulnerable web server, bypassing file extension protections and restrictions. This vulnerability does not work with ASP.Net.

Pending an IIS security patch, some workaround are available here.
 

-----------

Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org

Guy

418 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!