[VulnWatch] iDEFENSE Security Advisory 05.22.03: Authentication Bypass in iisPROTECT
From: iDEFENSE Labs (labs_at_idefense.com)
To: firstname.lastname@example.org Date: Thu, 22 May 2003 16:12:01 -0400
-----BEGIN PGP SIGNED MESSAGE-----
iDEFENSE Security Advisory 05.22.03:
Authentication Bypass in iisPROTECT
May 22, 2003
iisPROTECT is designed to provide password protection to web
directories similar to the htaccess method utilized by the Apache
Software Foundation's HTTP web server. More information about
iisPROTECT is available at http://www.iisprotect.com .
Upon successful installation and implementation of iisPROTECT, users
will be presented with a login and password dialog box when
attempting to access files contained in a protected directory.
Consider the following example:
An attacker can bypass this authentication by simply requesting the
same file through different URL-encoded representations. Examples of
these include but are not limited to:
Any remote attacker can exploit the above-described vulnerability to
bypass the access control restrictions imposed by iisPROTECT, thereby
exposing potentially sensitive files and information.
iisPROTECT 2.1 and 2.2 are vulnerable. Previous versions may be
vulnerable as well.
V. VENDOR FIX/RESPONSE
iisPROTECT has released version 220.127.116.11 to fix this vulnerability.
The latest version is available at www.iisprotect.com .
VI. CVE INFORMATION
The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
has assigned the identification number CAN-2003-0317 to this issue.
VII. DISCLOSURE TIMELINE
12/31/2002 Issue disclosed to iDEFENSE
04/16/2003 E-mail sent to email@example.com
04/16/2003 Response received from David Fearn of iisPROTECT
04/16/2003 Patch provided to iDEFENSE for verification
05/22/2003 Coordinated public disclosure
Get paid for security research
Subscribe to iDEFENSE Advisories:
send email to firstname.lastname@example.org, subject line: "subscribe"
iDEFENSE is a global security intelligence company that proactively
monitors sources throughout the world — from technical
vulnerabilities and hacker profiling to the global spread of viruses
and other malicious code. Our security intelligence services provide
decision-makers, frontline security professionals and network
administrators with timely access to actionable intelligence and
decision support on cyber-related threats. For more information,
visit http://www.idefense.com .
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
-----END PGP SIGNATURE-----