Microsoft IIS 'Escape Character Parsing' Vulnerability patch

RFC 1738 specifies that web servers must allow hexadecimal digits to be input in URLs by preceding them with the so-called 'escape' character, a percent sign. IIS complies with this specification, but
Download

Microsoft IIS 'Escape Character Parsing' Vulnerability patch Ranking & Summary

Advertisement

  • Rating:
  • License:
  • Freeware /
  • Publisher Name:
  • Microsoft
  • Publisher web site:
  • File Size:
  • 1K

Microsoft IIS 'Escape Character Parsing' Vulnerability patch Tags


Microsoft IIS 'Escape Character Parsing' Vulnerability patch Description

RFC 1738 specifies that web servers must allow hexadecimal digits to be input in URLs by preceding them with the so-called 'escape' character, a percent sign. IIS complies with this specification, but also accepts characters after the percent sign that are not hexadecimal digits. Some of these translate to printable ASCII characters, and this could provide an alternate means of specifying files in URLs.The vulnerability does not affect IIS, however, third-party software that runs atop IIS but does not perform canonicalization is affected by it.


Microsoft IIS 'Escape Character Parsing' Vulnerability patch Related Software

About SoftwareSea