Home page logo

bugtraq logo Bugtraq mailing list archives

Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053]
From: "Eiji James Yoshida" <ptrs-ejy () bp iij4u or jp>
Date: Sun, 1 Oct 2006 13:00:31 +0900

+ Title:
Microsoft Internet Information Services UTF-7 XSS Vulnerability

+ Date:
1 October 2006

+ Author:
Eiji James Yoshida [ptrs-ejy () bp iij4u or jp]

+ Risk:

+ Vulnerable:
Internet Information Services

+ Overview:
Using UTF-7 encoded URLs, IIS may return user specified content to the browser. 

If 'Encoding' is set to 'Auto Select', and Internet Explorer finds a UTF-7 string in the response's body, it will set 
the charset
encoding to UTF-7 automatically, unless a certain charset encoding is already enforced.

+ Proof of concept:

UTF-7("<") = +ADw-, +ADx-, +ADy-, +ADz-
UTF-7(">") = +AD4-, +AD5-, +AD6-, +AD7-
UTF-7("/") = +AC8-, +AC9-

+ Patch:
Microsoft Security Bulletin MS06-053
Vulnerability in Indexing Service Could Allow Cross-Site Scripting (920685)

+ Vendor status:
IPA/ISEC was notified on the 27th December 2005.
Microsoft has released a patch for this vulnerability on the 12th September 2006. 

+ Similar vulnerabilities:
XSS vulnerabilities in Google.com

Microsoft Security Bulletin (MS00-084)
Patch Available for 'Indexing Services Cross Site Scripting'

Eiji James Yoshida
penetration technique research site
E-mail: ptrs-ejy () bp iij4u or jp
URL: http://www.geocities.jp/ptrs_sec/index.htm

  By Date           By Thread  

Current thread:
  • Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053] Eiji James Yoshida (Oct 02)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]