IIS Escape Char Parsing - 31 Oct 1999

IIS Escape Char Parsing

Reported December 22, 1999 by
ACROS Security Team

Internet Information Server 4.0
  • Site Server 3.0
  • Site Server Commerce 3.0


    According to Microsoft"s bulletin, "RFC 1738 specifies that web servers must allow hexadecimal digits to be input in URLs by preceding them with the so-called "escape" character, a percent sign. IIS complies with this specification, but also accepts characters after the percent sign that are not hexadecimal digits. Some of these translate to printable ASCII characters, and this could provide an alternate means of specifying files in URLs.

    The vulnerability does not affect IIS; even specifying a file name via this alternate method does not bypass IIS" access controls. However, third-party software that runs atop IIS but does not perform canonicalization is affected by it.


    Microsoft released a FAQ, Support Online articles Q246401, as well as patches for Intel and Alpha that correct the issue.

    Discovered by
    ACROS Security Team

  • Hide comments


    • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

    Plain text

    • No HTML tags allowed.
    • Web page addresses and e-mail addresses turn into links automatically.
    • Lines and paragraphs break automatically.