Check Point Advisories

Microsoft IIS Filename Extension Parsing Security Bypass (CVE-2009-4444)

Vulnerability
Protection

Check Point Reference:	CPAI-2009-331
Date Published:	28 Dec 2009
Severity:	High
Last Updated:	Tuesday 20 October, 2015
Source:
Industry Reference:	CVE-2009-4444
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70, R65
Who is Vulnerable?
Vulnerability Description	A security bypass vulnerability has been discovered in Microsoft Internet Information Services (IIS). The vulnerability is due to an error in the IIS service that incorrectly parses filenames that contain a semicolon character when determining the MIME type based on the filename extension. An attacker may exploit this issue by crafting an HTTP POST request that will bypass the web application's filename extension security filters. Successful exploitation of this vulnerability would allow the attacker to upload an executable file with a non-executable extension on to the vulnerable server.

Protection Overview

This protection will detect and block HTTP requests attempting to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75 / R71 / R70 / R65

In the IPS tab, click Protections and find the Microsoft IIS Filename Extension Parsing Security Bypass protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Web Server Enforcement Violation.
Attack Information: Microsoft IIS filename extension parsing security bypass