Microsoft IIS Unicode Requests to WebDAV Multiple Authentication Bypass Vulnerabilities

Bugtraq ID:	34993
Class:	Access Validation Error
CVE:	CVE-2009-1535 CVE-2009-1676
Remote:	Yes
Local:	No
Published:	May 15 2009 12:00AM
Updated:	Jun 18 2009 04:49PM
Credit:	Nikolaos Rangos (Kingcope)
Vulnerable:	Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft IIS 5.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:	Microsoft IIS 7.0

Microsoft IIS Unicode Requests to WebDAV Multiple Authentication Bypass Vulnerabilities

Microsoft Internet Information Service (IIS) is prone to multiple authentication-bypass vulnerabilities because the application fails to properly enforce access restrictions on certain requests to password-protected WebDAV folders.

An attacker can exploit these issues to gain unauthorized access to protected WebDAV resources, which may lead to other attacks.

This issue affects IIS 5.0, 5.1, and 6.0.

Microsoft IIS Unicode Requests to WebDAV Multiple Authentication Bypass Vulnerabilities

Attackers may exploit these issues via a browser.

The following proof of concept and exploits are available.

NOTE: The file '34993_cadaver-0.23.2-h4x.patch' may be used with cadaver 0.23.2 to exploit this issue; please see the references for more information.

• /data/vulnerabilities/exploits/34993.rb
• /data/vulnerabilities/exploits/34993_cadaver-0.23.2-h4x.patch
• /data/vulnerabilities/exploits/34993.php
• /data/vulnerabilities/exploits/34993.pl
• /data/vulnerabilities/exploits/34993.py
• /data/vulnerabilities/exploits/34993.txt

Microsoft IIS Unicode Requests to WebDAV Multiple Authentication Bypass Vulnerabilities

Solution:
Microsoft has released a security advisory and fixes to address this issue. Please see the referenced advisory for details.

Microsoft IIS Unicode Requests to WebDAV Multiple Authentication Bypass Vulnerabilities

References:

• Answers to the IIS WebDAV authentication bypass questions (Microsoft)
  
• IIS 5 / IIS 5.1 / IIS 6 Webdav unicode - the bug that won't die ? (Thierry Zoller)
  
• Microsoft IIS 6.0 WebDAV Remote Authentication Bypass (Nikolaos Rangos)
  
• Microsoft IIS Homepage (Microsoft)
  
• More information about the IIS authentication bypass (Microsoft Security Research & Defense)
  
• UrlScan Security Tool (Microsoft)
  
• WebDAV Detection, Vulnerability Checking and Exploitation (Ron Bowes)
  
• New paper: Understanding Microsoft's KB971492 IIS WebDAV Vuln (Steve Friedl )
  
• ASA-2009-215 MS09-020 Vulnerabilities in Internet Information Services (IIS) (Avaya)
  
• Microsoft Security Advisory (971492) (Microsoft)
  
• Microsoft Security Bulletin MS09-020 - Important (Microsoft)
  
• Vulnerability Note VU#787932 Microsoft IIS 6.0 WebDAV Remote Authentication Bypa (US-CERT)