Microsoft IIS 5.0 WebDAV Authentication Bypass Vulnerability

Bugtraq ID:	35232
Class:	Access Validation Error
CVE:	CVE-2009-1122
Remote:	Yes
Local:	No
Published:	Jun 09 2009 12:00AM
Updated:	Jun 18 2009 04:30PM
Credit:	Yamata Li
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft IIS 5.0 WebDAV Authentication Bypass Vulnerability

Microsoft Internet Information Services (IIS) is prone to an authentication-bypass vulnerability because it fails to properly enforce access restrictions on certain requests to a site that requires authentication.

An attacker can exploit this issue to gain unauthorized access to protected resources, which may lead to other attacks.

This issue affects IIS 5.0.

Microsoft IIS 5.0 WebDAV Authentication Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft IIS 5.0 WebDAV Authentication Bypass Vulnerability

Solution:
Microsoft has released an advisory and fixes for this issue. Please see the references for details.


Microsoft IIS 5.0

• Microsoft Security Update for Windows 2000 (KB970483)
  http://www.microsoft.com/downloads/details.aspx?familyid=8515a294-4f25 -4dc5-860a-e7ad9b6c1c01&displaylang=en

Microsoft IIS 5.0 WebDAV Authentication Bypass Vulnerability

References:

• Microsoft IIS Homepage (Microsoft)
  
• ASA-2009-215 MS09-020 Vulnerabilities in Internet Information Services (IIS) (Avaya)
  
• Microsoft Security Bulletin MS09-020 - Important (Microsoft)