CVE-2009-1122
First published: Wed Jun 10 2009(Updated: )
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Information Services (IIS) | =5.0 | |
| Microsoft Windows 2000 | =sp4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securitytracker.com/id?1022358
- http://www.securityfocus.com/bid/35232
- http://www.vupen.com/english/advisories/2009/1539
- http://www.attrition.org/pipermail/vim/2009-June/002192.html
- http://www.us-cert.gov/cas/techalerts/TA09-160A.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020
Frequently Asked Questions
What is the severity of CVE-2009-1122?
CVE-2009-1122 is classified as a high severity vulnerability due to its potential to allow authentication bypass and unauthorized file access.
How do I fix CVE-2009-1122?
To fix CVE-2009-1122, it is recommended to upgrade from Microsoft Internet Information Services 5.0 to a more secure version, as there are no specific patches for this vulnerability.
What are the potential impacts of CVE-2009-1122?
The potential impacts of CVE-2009-1122 include unauthorized access to read or create files on the server due to the WebDAV authentication bypass.
What systems are affected by CVE-2009-1122?
CVE-2009-1122 specifically affects Microsoft Internet Information Services 5.0 running on Windows 2000 SP4.
Is CVE-2009-1122 still a threat today?
While CVE-2009-1122 primarily affected older systems, any remaining installations of IIS 5.0 may still be at risk if they have not been properly secured or decommissioned.
- collector/nvd-historical
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft internet information services (iis)
- version/microsoft internet information services (iis)/5.0
- canonical/microsoft windows 2000
- version/microsoft windows 2000/sp4