PT-2000-1583 · Microsoft · Iis

Publicado 2000-07-13 · Atualizado 2020-11-23 · CVE-2000-0649

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IIS version 4.0

Description The issue allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

Recommendations For IIS version 4.0, define a realm for web pages protected by basic authentication to prevent disclosure of the internal IP address.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2000-0649

Produtos afetados

Iis

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/iis_internal_ip.rb · Exploit
• 🔥 https://github.com/rafaelh/CVE-2000-0649 · Exploit
• 🔥 https://exploit-db.com/exploits/20096 · Exploit
• 🔥 http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html · Exploit
• 🔥 http://securityfocus.com/bid/1499 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0649 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-0649 · Nota de Segurança