CVE-2009-4444

Published Dec 29, 2009 microsoft

Overview

CVE-2009-4444 is a known-severity vulnerability affecting microsoft internet_information_services. It was published on December 29, 2009.

Technical Description

Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file.

Remediation

Check the references section for vendor advisories and patches from microsoft. Update internet_information_services to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status

References

Ref blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspx Ref secunia.com/advisories/37831 Ref securitytracker.com/id?1023387 Ref soroush.secproject.com/downloadable/iis-semicolon-report.pdf Ref www.securityfocus.com/bid/37460 Ref www.vupen.com/english/advisories/2009/3634 Ref blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspx Ref secunia.com/advisories/37831 Ref securitytracker.com/id?1023387 Ref soroush.secproject.com/downloadable/iis-semicolon-report.pdf

Frequently Asked Questions

What is CVE-2009-4444?

CVE-2009-4444 is a known-severity vulnerability affecting microsoft internet_information_services. It was published on December 29, 2009.

How severe is CVE-2009-4444?

CVSS score information is not yet available for this vulnerability. Check back as the CVE record is updated by NVD analysts.

How do I fix or remediate CVE-2009-4444?

How can CyberStrike help with CVE-2009-4444?

CyberStrike's AI-powered security agents can automatically detect CVE-2009-4444 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.