Remote file bypass vulnerability in Microsoft Internet Security and Acceleration Server 2004

CVE-2006-3652

Summary

The Microsoft Internet Security and Acceleration (ISA) Server 2004 contains a vulnerability that enables remote attackers to bypass file extension filters. This occurs when an attacker sends a specially crafted request that includes a trailing '#' character, allowing them to potentially access files that should be restricted by these filters. Despite attempts to reproduce the issue, confirmation and test cases from third parties have not been consistent, raising concerns about the effectiveness of the filter implementation.

References