Microsoft IIS contains a flaw that is triggered due to an error in handling data stream requests. By sending a direct request with the $INDEX_ALLOCATION data stream embedded in the URL, an attacker can bypass authentication and access PHP or ASP files that would otherwise be protected.
Classification
Location:
Remote / Network Access
Attack Type:
Authentication Management,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Solution:
Solution Unknown
Exploit:
Exploit Public
Disclosure:
Uncoordinated Disclosure
OSVDB:
Web Related
Solution
OSVDB is not aware of a solution for this vulnerability.
