Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is Double-Encoding still a security vulnerability on IIS6 as it was in IIS4/5?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

The answer is yes and no, Strictly speaking, on the MS-API level, The issue has been rectified. Of course, if your application deals with encoding and requests paths that may not be contingent upon the URI provided - You're vulnerable and you're going to want to provide filtering AFTER any applicable encoding has been done.

share|improve this answer
add comment

What do you mean with Double-Encoding ? If it you talk about IIS Unicode Vulnerability (explained in http://www.hackingspirits.com/eth-hac/papers/iis%5Funi.html) , it's been resolved many years ago. IIS 6.0 is not vulnerable to this attack.

share|improve this answer
add comment

If you are talking about this kind of web application attack, then this is really most often due to a problem in the web application's code and not the web server behaviour. This particular issue is a problem on any and all web servers.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.