Signature Detail

HTTP: IIS ASP.Net Directory Authentication Bypass

This signature detects backslash (\) characters in the URL portion of an HTTP request. Attackers can use a backslash as a directory separator instead of the normal forward slash (/) to bypass the Microsoft IIS ASP.Net authentication capabilities and access protected resources. Note: A poorly configured Web server can also display a backslash in a non-malicious URL request.

Extended Description

Microsoft ASP.NET is reported prone to a remote information-disclosure vulnerability because the application fails to properly secure documents when handling malformed URI requests. An attacker may leverage this issue to bypass authentication required to access files in secured directories.

Affected Products

• Microsoft asp.net 1.0
• Microsoft asp.net 1.1
• Microsoft asp.net
• Microsoft .net_framework 1.0
• Microsoft .net_framework 1.0 SP1
• Microsoft .net_framework 1.0 SP2
• Microsoft .net_framework 1.0 SP3
• Microsoft .net_framework 1.1
• Microsoft .net_framework 1.1 SP1

References

• BugTraq: 11342
• CVE: CVE-2004-0847
• URL: http://support.microsoft.com/?kbid=887459
• URL: http://www.microsoft.com/technet/security/bulletin/ms05-004.mspx
• URL: http://www.us-cert.gov/cas/techalerts/TA05-039A.html