CVE-2009-4445: microsoft internet_information_services Improper Input Validation

Vulnerability summary

CVE-2009-4445 is a medium (CVSS 6.0) Improper Input Validation vulnerability in microsoft internet_information_services. EPSS estimates a 12.76% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities.

Timeline

1. 29-12-2009
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with arbitrary extensions via a filename containing an initial extension followed by a : (colon) and a safe extension, as demonstrated by an upload of a .asp:.jpg file that results in creation of an empty .asp file, related to support for the NTFS Alternate Data Streams (ADS) filename syntax. NOTE: it could be argued that this is a vulnerability in the third-party product, not IIS, because the third-party product should be applying its extension restrictions to the portion of the filename before the colon.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.