| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: 25 Jan 2011 18:13:50 -0000 From: info@...uritylab.ir To: bugtraq@...urityfocus.com Subject: Microsoft IIS 6 parsing directory “x.asp” Vulnerability ############################################################ # Microsoft IIS 6 parsing directory Vulnerability ############################################################ #Discovered by: Pouya daneshmand whh_iran[AT]yahoo[DOT]com http://securitylab.ir/blog #Introduction: Using this vulnerability you can bypass some Security filters, for example a file with “.jpg” or “.rar” extension can be executed as an asp (Active Server Page) file. #Vulnerable: It just works for asp files and works on Windows 2003 / IIS 6 (As I tested...). The test failed on IIS 5.1 and IIS 7. #Description: 1) Create a Folder with '.asp' extension. 2) Insert your ASP code in a file with any extension (like .jpg,.rar,.txt) in the folder you have created. 3) Open the file with your browser and you will see it's executed as an asp file! #Note: The Extension of file does not matter at all! #Solution: There is no patch to fix this security vulnerability yet, the best thing I can say is to DISABLE ASP FILES FROM YOUR "web server extensions"! Or Remove “execute” permission from the upload directories. #PS: This vulnerability was reported for first time at 2010-06-19 in Persian (http://sebug.net/vulndb/19820/) #Original Advisory: http://securitylab.ir/blog/dl/Microsoft-IIS6-parsing-directory-Vulnerability.pdf http://securitylab.ir/blog/posts/11/Microsoft-IIS-6-parsing-directory-%E2%80%9Cx.asp%E2%80%9D-Vulnerability/
Powered by blists - more mailing lists