Authentication flaw

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

CVE-2009-1122

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

CVE-2009-1122

CVE-2009-1122 is the IIS WebDAV authentication bypass vulnerability associated with the MS09-020 family. The Initial Description notes an improper URL decode in IIS WebDAV that can bypass authentication and allow reading/creating files via crafted HTTP requests. Connected documents corroborate an...

CVE-2009-1122

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

Authentication flaw

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

CVE-2009-1535

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

CVE-2009-1535

CVE-2009-1535 corresponds to the IIS WebDAV Unicode authentication bypass vulnerability affecting IIS 5.1/6.0. The issue permits remote bypass of URI-based protections and can allow listing, reading, creation, or modification of files by injecting a Unicode sequence (notably %c0%af) into the URI,...

CVE-2009-1535

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

CVE-2009-1122: Improper Authentication

The WebDAV extension in Microsoft Internet Information Services IIS 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability...

Microsoft IIS Security Bypass Vulnerability (970483)

This host is missing a critical security update according to Microsoft Bulletin MS09-020. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2009-1535: Improper Authentication

The WebDAV extension in Microsoft Internet Information Services IIS 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af Unicode / character at an arbitrary position in the URI, as demonstrated by inserting...

Microsoft unleashes 31 fixes on Patch Tuesday

From ZDNet Ryan Naraine Microsoft’s batch of patches this month is a big one: 10 bulletins covering a total of 31 documented vulnerabilities affecting the Windows OS, the Internet Explorer browser and the Microsoft Office productivity suite Word, Works and Excel. Five of the 10 bulletins are rate...

Inside Patch Tuesday: MS patches IIS WebDav, PWN2OWN flaws

Microsoft released 10 security bulletins today. Six of the bulletins impact the Windows operating system, while one applies to the Internet Explorer browser and three affects Microsoft Office Word, Excel, Works. Some interesting notes for today: 1. Microsoft has patched the IIS WebDav 0-day. This...

Microsoft IIS Anonymous HTTP Request Authentication Bypass (MS09-020; CVE-2009-1122)

Web Distributed Authoring and Versioning WebDAV is a set of extensions for HTTP that allow clients to publish, lock, and manage resources on the Web. An elevation of privilege vulnerability has been reported in the Microsoft Windows WebDAV extension for IIS. The vulnerability is due to an error i...

Microsoft IIS WevDAV authentication bypass

It's possible to access resources? requireing authentication anonymously...

Apache apr-util webDav DoS

Memory consuption on large number of Entity elements...

The father of all bombs - another webdav fiasco

Apache moddav / svn Remote Denial of Service Exploit Google Dorks: inurl:svn inurl:trunk "powered by subversion version" Information on the bug XML Bomb: http://blog.didierstevens.com/2008/09/23/dismantling-an-xml-bomb/ Enjoy! -------------------------------------------------------------------...

Apache mod_dav svn - Remote Denial of Service

Apache moddav svn - Remote Denial of Service furoffyourcat.pl Apache moddav / svn Remote Denial of Service Exploit by kcope / June 2009 Will exhaust all system memory Needs Authentication on normal DAV This can be especially serious stuff when used against svn subversion servers!! Svn might let t...

A guide to the IIS WebDAV vulnerability

Even for the most experienced security professionals, understanding complex attacks and vulnerabilities sometimes can be a serious challenge. A perfect example is the recent Microsoft IIS WebDAV vulnerability, which surfaced last week and has yet to be patched by Microsoft. It’s a complicated...

WebTuff IIS 6.0 WebDAV Authentication Bypass

""" WebTuff v1.0 Copyright 2009, Raviv Raz - [email protected] WebTuff is distributed under the terms of the GNU General Public License WebTuff is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation,...