Security Advisory
- Microsoft Internet Information Services Basic Authentication Security Bypass Reported Date: 05-07-10
Rated Level: 
Impact: Security,Remotely Exploitable
Affected Software: Microsoft Internet Information Services (IIS) 5.x
Description: Soroush Dalili has discovered a vulnerability in Microsoft Internet Information Services, which can be exploited by malicious people to bypass certain security restrictions.
The vulnerability is caused due to an error in the handling of basic authentication for directories. This can be exploited to bypass authentication and access e.g. protected directories by appending the NTFS stream name and stream type (":$i30:$INDEX_ALLOCATION") to the directory name within a request.
The vulnerability is confirmed in version 5.1 on a fully-patched Windows XP SP3. Other versions may also be affected.
The vulnerability is caused due to an error in the handling of basic authentication for directories. This can be exploited to bypass authentication and access e.g. protected directories by appending the NTFS stream name and stream type (":$i30:$INDEX_ALLOCATION") to the directory name within a request.
The vulnerability is confirmed in version 5.1 on a fully-patched Windows XP SP3. Other versions may also be affected.
Note: Soroush Dalili
Solution:
Do not rely on the basic authentication method to restrict access to resources.
Original Advisory: http://soroush.secproject.com/blog/2010/07/iis5-1-directory-authentication-bypass-by-using-i30index_allocation/
Feedback: If you have additional information or corrections for this security advisory please contact us at advisory(at)triviasecurity.org
- Cpanel v11.25 PHP Restriction Bypass Vulnerability (03/09/10)
- cPanel Customer Portal (index.cgi) Xss Vulnerability (03/09/10)
- TFTP Desktop v2.5 Directory Traversal Vulnerability (03/09/10)
- TFTPDWIN v0.4.2 Directory Traversal Vulnerability (03/09/10)
- Apple QuickTime FlashPix NumberOfTiles Remote Code Execution Vulnerability (03/09/10)
- Novell Netware 6.5 OpenSSH Remote Stack Overflow (03/09/10)
- Microsoft Visio 2010 v14.0.4514.1004 (dwmapi.dll) DLL Hijacking Exploit (27/08/10)
- Microsoft Windows Power Point 2007 DLL Hijacking Exploit (pp4x322.dll) (27/08/10)
- Windows Live Messenger (Build 14.0.8117.416) dll (msgsres.dll) Hijacking exploit (27/08/10)
- Windows Live Messenger (Build 1.0.8117.416) dll (msgsres.dll) Hijacking exploit (27/08/10)
- Copyright © 2003-2010 TriviaSecurity Team