Some vulnerabilities have been reported in Microsoft Internet Information Services (IIS), which can be exploited by malicious people to bypass certain security restrictions.

1) An error exists in the handling WebDAV requests for directories requiring authentication. This can be exploited to bypass access restrictions and e.g. download files from protected folders by issuing an HTTP GET request containing Unicode characters and a "Translate: f" HTTP header.

Successful exploitation may allow uploading arbitrary files to protected WebDAV folders.

2) An error in the WebDAV extension when decoding URLs can be exploited to bypass access restrictions and e.g. download normally restricted files by requesting a specially crafted URL.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Nikolaos Rangos (Kingcope)
2) The vendor credits Yamata Li of Palo Alto Networks.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Microsoft:
http://www.microsoft.com/technet/security/Bulletin/MS09-020.mspx

Microsoft (KB971492):
http://www.microsoft.com/technet/security/advisory/971492.mspx

http://blogs.technet.com/srd/archive/2009/05/18/more-information-about-the-iis-authentication-bypass.aspx

Deep Links
Links available to Secunia VIM customers