2024-07-14 02:06:08 +00:00

96 lines
3.7 KiB
JSON

{
"id": "CVE-2009-4445",
"sourceIdentifier": "cve@mitre.org",
"published": "2009-12-29T21:00:24.453",
"lastModified": "2017-08-17T01:31:35.490",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with arbitrary extensions via a filename containing an initial extension followed by a : (colon) and a safe extension, as demonstrated by an upload of a .asp:.jpg file that results in creation of an empty .asp file, related to support for the NTFS Alternate Data Streams (ADS) filename syntax. NOTE: it could be argued that this is a vulnerability in the third-party product, not IIS, because the third-party product should be applying its extension restrictions to the portion of the filename before the colon."
},
{
"lang": "es",
"value": "Microsoft Internet Information Services (IIS), cuando es utilizado junto con aplicaciones de subida de archivos de terceras partes sin especificar, permite a atacantes remotos crear ficheros vac\u00edos con extensiones de su elecci\u00f3n a trav\u00e9s de un nombre de fichero que contiene una extensi\u00f3n inicial seguida por : (dos puntos) y una extensi\u00f3n segura; como se ha demostrado con la subida de un fichero .asp:.jpg que resulta en la creacci\u00f3n de un fichero vac\u00edo .asp. Relacionado con el soporte de la sintaxis de nombres de ficheros de NTFS Alternate Data Streams (ADS). NOTA: se podr\u00eda decir que es una vulnerabilidad del producto de terceras partes, no de IIS, porque el producto de terceras partes deber\u00eda imponer restricciones a las extensiones en la porci\u00f3n de nombre de fichero anterior a los dos puntos."
}
],
"metrics": {
"cvssMetricV2": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"accessVector": "NETWORK",
"accessComplexity": "MEDIUM",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": true,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:internet_information_services:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0",
"matchCriteriaId": "5CB4C943-1963-41A8-9D40-D79C0488219B"
}
]
}
]
}
],
"references": [
{
"url": "http://securitytracker.com/id?1023387",
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf",
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55308",
"source": "cve@mitre.org"
}
]
}