CVE-2009-4445 File upload in n/a
Remote attackers can upload malicious files with arbitrary extensions via NTFS Alternate Data Streams syntax, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-4445?
CVE-2009-4445 is a medium-severity vulnerability in Microsoft Internet Information Services, published on 29 Dec 2009. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with arbitrary extensions via a filename containing an initial extension followed by a : (colon) and a safe extension, as demonstrated by an upload of a .asp:.jpg file that results in creation of an empty .asp file, related to support for the NTFS Alternate Data Streams (ADS) filename syntax. NOTE: it could be argued that this is a vulnerability in the third-party product, not IIS, because the third-party product should be applying its extension restrictions to the portion of the filename before the colon.
Weakness: CWE-20
Which versions are affected by CVE-2009-4445?
It affects 1 product.
Products include Microsoft Internet Information Services.
How do I fix CVE-2009-4445?
No fix has been published for CVE-2009-4445 yet. Limit exposure of the affected software until one is available.
Is CVE-2009-4445 being exploited?
There is no known exploitation of CVE-2009-4445 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Internet Information Services
- CVE-2017-7269 Microsoft Windows Server Buffer Overflow
- CVE-2010-3972 Memory corruption in n/a
- CVE-2008-4301 Other in n/a
- CVE-2007-2815 The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL
- CVE-2003-0224 Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web pa
Sources
Also known as GHSA-vgvh-f7c3-rv4v.