Signature Detail
Short Name |
HTTP:IIS:IIS-AUTH-BYPASS |
|---|---|
Severity |
Medium |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Internet Information Services (IIS) Authentication Bypass |
Release Date |
2009/06/09 |
Update Number |
1449 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Internet Information Services (IIS) Authentication Bypass
This signature detects attempts to exploit a known vulnerability against Microsoft IIS. Attackers can bypass access restrictions, gaining access to files or directories without providing authentication credentials.
Extended Description
Microsoft Internet Information Services (IIS) is prone to an authentication-bypass vulnerability because it fails to properly enforce access restrictions on certain requests to a site that requires authentication. An attacker can exploit this issue to gain unauthorized access to protected resources, which may lead to other attacks. This issue affects IIS 5.0.
Affected Products
- Avaya Messaging Application Server MM 1.1
- Avaya Messaging Application Server MM 2.0
- Avaya Messaging Application Server MM 3.0
- Avaya Messaging Application Server MM 3.1
- Avaya Messaging Application Server
- Microsoft IIS 5.0
References
- BugTraq: 35232
- CVE: CVE-2009-1122