[NT] Authentication Bypass in iisPROTECT
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 26 May 2003 11:44:26 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
In the US?
Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!
Please contact us at: 323-882-8286 or email@example.com
- - - - - - - - -
Authentication Bypass in iisPROTECT
<http://www.iisprotect.com/> iisPROTECT is designed to provide password
protection to web directories similar to the htaccess method utilized by
the Apache Software Foundation's HTTP web server. A vulnerability in the
product allows bypassing the protection mechanism.
* iisPROTECT version 2.1 and 2.2
* iisPROTECT version 126.96.36.199
Upon successful installation and implementation of iisPROTECT, users will
be presented with a login and password dialog box when attempting to
access files contained in a protected directory.
Consider the following example:
An attacker can bypass this authentication by simply requesting the same
file through different URL-encoded representations. Examples of these
include but are not limited to:
12/31/2002 Issue disclosed to iDEFENSE
04/16/2003 E-mail sent to firstname.lastname@example.org
04/16/2003 Response received from David Fearn of iisPROTECT
04/16/2003 Patch provided to iDEFENSE for verification
05/22/2003 Coordinated public disclosure
The information has been provided by <mailto:email@example.com> iDEFENSE
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.