Test Methods ( Detailed Overview )

Here is a list of every test performed by Web Scan Service.

IIS Unicode Arbitrary Command Execution

Remediation Task

Install patch or upgrade version

WASC Classification

Command Execution: OS Commanding

Affected Products

Microsoft IIS 4.0 and 5.0

Technical Description

Unicode Characters are decoded after the directory traversal check is done, so it is possible to bypass the intern security checks to access a file.

Fix Recommendation

Either you install a patch on your system or you should upgrade the software version to one higher than the affected ones.