NVD

Id
51567  
Name
CVE-2009-4444  
Description
Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-12-29  
Modified Date
2010-06-28  
Seq
2009-4444  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
261453 51567 CVE-2009-4444 http://blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspx  View
261454 51567 CVE-2009-4444 1023387  View
261455 51567 CVE-2009-4444 http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf  View
261456 51567 CVE-2009-4444 37460  View
261457 51567 CVE-2009-4444 ADV-2009-3634  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
44232 JVNDB-2009-005239 Microsoft IIS におけるサードパーティの拡張制限を回避される脆弱性 Microsoft Internet Information Services (IIS) は、; (セミコロン) 文字の前のファイル名の一部のみ使用してファイル拡張子を決定するため、アプリケーションをアップロードするサードパーティの拡張制限を回避される脆弱性が存在します。 CVE-2009-4444 41875 CVE-2009-4444 51567 6 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-005239.html 2009-12-27 2012-09-25 View