0

Is Double-Encoding still a security vulnerability on IIS6 as it was in IIS4/5?

3 Answers 3

1

The answer is yes and no, Strictly speaking, on the MS-API level, The issue has been rectified. Of course, if your application deals with encoding and requests paths that may not be contingent upon the URI provided - You're vulnerable and you're going to want to provide filtering AFTER any applicable encoding has been done.

0

What do you mean with Double-Encoding ? If it you talk about IIS Unicode Vulnerability (explained in http://www.hackingspirits.com/eth-hac/papers/iis_uni.html) , it's been resolved many years ago. IIS 6.0 is not vulnerable to this attack.

0

If you are talking about this kind of web application attack, then this is really most often due to a problem in the web application's code and not the web server behaviour. This particular issue is a problem on any and all web servers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .