[VIM] IIS WebDav Vulnerability CVE ID

[Steven M. Christey]

Hi,

Just to confirm, these are duplicate IDs - they were assigned on the same
day, independently, by both MITRE and Microsoft.

Please use CVE-2009-1535; we're rejecting CVE-2009-1676.  See below.

- Steve


======================================================
Name: CVE-2009-1535
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1535
Reference: FULLDISC:20090515 IIS6 + webdav and unicode rides again in 2009
Reference: URL:http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0135.html
Reference: FULLDISC:20090515 Re: IIS6 + webdav and unicode rides again in 2009
Reference: URL:http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0144.html
Reference: FULLDISC:20090515 Re: IIS6 + webdav and unicode rides again in 2009
Reference: URL:http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0139.html
Reference: MISC:http://archives.neohapsis.com/archives/fulldisclosure/2009-05/att-0135/IIS_Advisory.pdf
Reference: MISC:http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
Reference: MISC:http://isc.sans.org/diary.html?n&storyid=6397
Reference: MISC:http://view.samurajdata.se/psview.php?id=023287d6&page=1

The WebDAV extension in Microsoft Internet Information Services (IIS)
5.1 and 6.0 allows remote attackers to bypass URI-based protection
mechanisms, and list folders or read, create, or modify files, via a
%c0%af (Unicode / character) at an arbitrary position in the URI, as
demonstrated by inserting %c0%af into a "/protected/" initial pathname
component to bypass the password protection on the protected\ folder,
aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability."


======================================================
Name: CVE-2009-1676
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1676

** REJECT **

DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1535.  Reason:
This candidate is a duplicate of CVE-2009-1535.  Notes: All CVE users
should reference CVE-2009-1535 instead of this candidate.  All
references and descriptions in this candidate have been removed to
prevent accidental usage.