Tenable Network Security
Solutions Products Nessus Demos Partners Online Store
Nessus
Download
Plugins
     Newest Plugins
     Obtain an activation code
     View all plugins
     Search
Documentation
Register
Buy Now
ProfessionalFeed Support
Bugs
All the Tenable Products

Microsoft IIS WebDAV Unicode Request Directory Security Bypass
This script is Copyright (C) 2009-2010 Tenable Network Security, Inc.

FamilyWeb Servers
Nessus Plugin ID38808 (webdav_iis6_flaw.nasl)
Bugtraq ID34993
CVE IDCVE-2009-1535

Description:
Synopsis :

It is possible to access protected resources through WebDAV.

Description :

IIS 6.0 does not properly sanitize WebDAV requests. It is possible
to access protected resources by inserting a Unicode / (%c0%af) in the
URL.

Depending on the remote server configuration, protected resources may
be browsed, read and/or modified.

See also :

http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
http://seclists.org/fulldisclosure/2009/May/att-0134/IIS_Advisory_pdf
http://www.sans.org/reading_room/whitepapers/threats/unicode_vulnerability_how_why_458
http://isc.sans.org/diary.html?storyid=6397
http://www.microsoft.com/technet/security/advisory/971492.mspx
http://unixwiz.net/techtips/ms971492-webdav-vuln.html

Solution :

Disable WebDAV if you do not use it, or update your server.
See http://forums.iis.net/t/1149348.aspx

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
About us | Whitepapers | Training | Discussion Forums | Support Portal | Blog | RSS feeds | Contact us | Legal | Privacy

© Copyright 2002 - 2010 Tenable Network Security(R). All Rights Reserved.

This is the web site for the Nessus Vulnerability Scanner from Tenable Network Security. If you are looking for the probabilistic analysis software from Southwest Research Institute, please visit www.nessus.swri.org