# MA-206.122009: MyCERT Alert - Critical Vulnerability in Microsoft Internet Information Server (IIS) in Parsing File

**Date:** 29 Dec 2009  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-206.122009  
**Advisory ID:** MA-206.122009

---

**1.0 Introduction**
A critical vulnerability has been identified in Microsoft Internet Information Server (IIS) where the Microsoft IIS may interpret unexpected files as CGI applications. Attackers may be able to exploit this vulnerability to bypass intended security restrictions and execute arbitrary code on a vulnerable system.
**2.0 Impact**
By exploiting this vulnerability, an attacker could execute arbitrary ASP code in the context of the Microsoft Internet Information Server process. This may facilitate a compromise of the application and the underlying system, unauthorized disclosure of information, unauthorized modification and also disruption of service.
**3.0 Affected Products**
Microsoft Windows operating systems and components listed below are vulnerable to this vulnerability:
- Microsoft Internet Information Server 6.0
- Microsoft Internet Information Server 5.1
- Microsoft Internet Information Server 5.0
- Microsoft Internet Information Server 4.0
- Microsoft Internet Information Server 3.0
- Microsoft Internet Information Server 2.0
- Microsoft Internet Information Server 1.0
**4.0 Recommendation**
As of the writing of this advisory, Microsoft has not released any security patches for this vulnerability. However users can use the following step as a temporary workaround:
**For Web Developers**
- Use a completely random string as a filename and set its extension by the web application itself (by using a "switch-case or select-case" for example) and never accept the user’s input as the filename.
- Only accept alpha-numerical strings as the filename and its extension.
- Follow 8 Basic Rules to Implement Secure File Uploads:
<https://blogs.sans.org/appsecstreetfighter/2009/12/28/8-basic-rules-to-implement-secure-file-uploads/>
- Follow Improving Web Application Security: Threats and Countermeasures:
<http://msdn.microsoft.com/en-us/library/ms994921.aspx>
**For System Administrator**
- Remove "execute" permission from the upload directories.
- Follow IIS 6.0 Security Best Practices:
<http://technet.microsoft.com/en-us/library/cc782762(WS.10).aspx>
- Follow Securing Sites with Web Site Permissions:
<http://technet.microsoft.com/en-us/library/cc756133(WS.10).aspx>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#64071d0601165d5d5d24071d06011617010711160d101d4a091d) or [[email protected]](/cdn-cgi/l/email-protection#7e13071d1b0c0a3e13071d1b0c0a50110c19501307)
Phone : +603 89926969  or 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : +60 19 2813801 (24x7 SMS reporting)
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.securityfocus.com/bid/37460/>
- <http://isc.sans.org/diary.html?storyid=7816>
- <https://blogs.sans.org/appsecstreetfighter/2009/12/28/8-basic-rules-to-implement-secure-file-uploads/>
- <http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf>
- <http://www.securityfocus.com/archive/1/508604>
- <http://blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspx>