lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: 25 Jan 2011 18:13:50 -0000
From: info@...uritylab.ir
To: bugtraq@...urityfocus.com
Subject: Microsoft IIS 6 parsing directory “x.asp” Vulnerability

############################################################
# Microsoft IIS 6 parsing directory Vulnerability
############################################################
#Discovered by: 
Pouya daneshmand
whh_iran[AT]yahoo[DOT]com
http://securitylab.ir/blog

#Introduction:
Using this vulnerability you can bypass some Security filters, for example a file with “.jpg” or “.rar” extension can be executed as an asp (Active Server Page) file.

#Vulnerable:
It just works for asp files and works on Windows 2003 / IIS 6 (As I tested...).
The test failed on IIS 5.1 and IIS 7.


#Description:
1) Create a Folder with '.asp' extension.
2) Insert your ASP code in a file with any extension (like .jpg,.rar,.txt) in the folder you have created.
3) Open the file with your browser and you will see it's executed as an asp file!

#Note:
The Extension of file does not matter at all!


#Solution:
There is no patch to fix this security vulnerability yet, the best thing I can say is to DISABLE ASP FILES FROM YOUR "web server extensions"! Or Remove “execute” permission from the upload directories.



#PS:
This vulnerability was reported for first time at 2010-06-19 in Persian (http://sebug.net/vulndb/19820/)

#Original Advisory:
http://securitylab.ir/blog/dl/Microsoft-IIS6-parsing-directory-Vulnerability.pdf
http://securitylab.ir/blog/posts/11/Microsoft-IIS-6-parsing-directory-%E2%80%9Cx.asp%E2%80%9D-Vulnerability/

Powered by blists - more mailing lists