Is Double-Encoding still a security vulnerability on IIS6 as it was in IIS4/5?
3 Answers
The answer is yes and no, Strictly speaking, on the MS-API level, The issue has been rectified. Of course, if your application deals with encoding and requests paths that may not be contingent upon the URI provided - You're vulnerable and you're going to want to provide filtering AFTER any applicable encoding has been done.
What do you mean with Double-Encoding ? If it you talk about IIS Unicode Vulnerability (explained in http://www.hackingspirits.com/eth-hac/papers/iis_uni.html) , it's been resolved many years ago. IIS 6.0 is not vulnerable to this attack.
If you are talking about this kind of web application attack, then this is really most often due to a problem in the web application's code and not the web server behaviour. This particular issue is a problem on any and all web servers.