OSVDB ID: 436 Title: Microsoft IIS Unicode Remote Command Execution |
Info |
|
|
Dates |
||||
|
|
Description |
Microsoft Internet Information Server (IIS) contain a flaw that allows a remote attacker to access any file or folder on the Web Server with "anonymous" access. The issue is due to IIS failing to handle Unicode characters in URI requests. By replacing slashes and backslashes with their Unicode equivilent, an attacker can bypass the sanity checks present in IIS that would normally filter and deny such requests. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Solution: Patch / RCS Exploit: Exploit Public, Exploit Commercial Disclosure: Vendor Verified OSVDB: Web Related |
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |