<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-4444" target="_blank">CVE</a>)</em> : Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file.

OSVDB is not aware of a solution for this vulnerability.

Unknown or Incomplete

• Security Tracker: 1023387
• CVE ID: 2009-4444 (see also: NVD)
• Bugtraq ID: 37460
• Secunia Advisory ID: 37831
• SCIP VulDB ID: 4074
• VUPEN Advisory: ADV-2009-3634
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2009-12/0291.html
  http://archives.neohapsis.com/archives/bugtraq/2009-12/0304.html
• Other Advisory URL: http://blog.metasploit.com/2009/12/exploiting-microsoft-iis-with.html
  http://blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspx
  http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf
• Vendor Specific Advisory URL: http://blogs.technet.com/msrc/archive/2009/12/29/results-of-investigation-into-holiday-iis-claim.aspx
• News Article: http://www.scmagazineus.com/new-iis-flaw-deemed-low-risk-in-proper-configurations/article/160283/
  http://www.theregister.co.uk/2009/12/25/microsoft_iis_semicolon_bug/

• Soroush Dalili - Soroush Dalili's Site