Security Information and Review

Collection of security information and review

Microsoft IIS 5.0 WebDAV Vulnerability

Author : Admin

WebDAV : Web distributed Authoring and Versioning is an extension to the Hyper Text Transfer Protocol ( HTTP ) that defines how basic file functions such copy, move, delete and create are performed by a computer using HTTP. So, WebDAV is extension in Microsoft Internet Information Services (IIS) 5.0 which is default activated.


A vulnerability was found in Microsoft IIS 5.0, 5.1 and 6.0 with WebDAV extension is activated. With this vulnerabilty  allowing an attacker to gain access to locations which normally require authentication.


The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 does not properly decode URLs, which allows remote attackers to bypass authentication, an attacker can exploit this issue to gain unauthorized access to protected resources, which may lead to other attacks and possibly read or create files, via a crafted HTTP request. This vulnerability was found in June 09, 2009 and updated June 17, 2009. These vulnerabilities allow an attacker to bypass the IIS configuration that specifies which type of authentication is allowed, but not the file system-based access control list (ACL) check that verifies whether a file is accessible by a given user. Successful exploitation of these vulnerabilities would still restrict the attacker to the permissions granted to the anonymous user account by the file system ACLs.


For information detail about this vulnerabilty, see at Microsoft Security Bulletin MS09-020 and update was released by Microsoft and available to download at Security Update for Windows 2000 (KB970483).  This security update is rated Important for Microsoft Internet Information Services on all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003. The security update addresses the vulnerabilities by modifying the way that the WebDAV extension for IIS handles HTTP requests.


For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update at the earliest opportunity using update management software, or by checking for updates using the Microsoft Update service.

Share and Enjoy: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • Netvouz
  • DZone
  • ThisNext
  • MisterWong
  • Wists
  • Technorati
  • YahooMyWeb
  • Slashdot
  • StumbleUpon
Categories: Windows Security
If you like this posts, please leave messages / comments.