{
  "id": "CVE-2009-4444",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2009-12-29T21:00:24.327",
  "lastModified": "2020-11-23T19:50:33.257",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file."
    },
    {
      "lang": "es",
      "value": "Microsoft Internet Information Services (IIS) 5.x y 6.x usa s\u00f3lo la porci\u00f3n de un nombre de fichero antes de un caracter ; (punto y coma) para determinar la extensi\u00f3n del fichero, lo que permite a atacantes remotos eludir las restricciones de extensi\u00f3n previstas para aplicaciones de subida de ficheros de terceros mediante un nombre de fichero con una primera extensi\u00f3n (1) .asp, (2) .cer o (3) .asa seguida de un punto y coma y una extensi\u00f3n segura, tal y como se ha quedado demostrado al usar asp.dll para manejar un fichero .asp;.jpg."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "413C07EA-139F-4B7D-A58B-835BD2591FA0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:microsoft:internet_information_services:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B4DF95D-B4B1-4FB6-9D27-A6D359EEACFA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspx",
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "http://securitytracker.com/id?1023387",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/37460",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3634",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}