PT-2002-1475 · Microsoft · Iis

Publicado 2002-06-11 · Atualizado 2008-09-05 · CVE-2002-0421

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IIS version 4.0

Description The issue allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling certain .htr password changing programs. These programs include aexp2.htr, aexp2b.htr, aexp3.htr, and aexp4.htr in the /iisadmpwd directory.

Recommendations For IIS version 4.0, consider restricting access to the /iisadmpwd directory and the specific .htr programs (aexp2.htr, aexp2b.htr, aexp3.htr, and aexp4.htr) to prevent unauthorized password changes.

Correção

Identificadores relacionados

CVE-2002-0421

Produtos afetados

Iis

Referências · 4

• http://online.securityfocus.com/archive/1/259963 · Aviso do Fabricante
• http://securityfocus.com/bid/4236 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0421 · Nota de Segurança
• http://iss.net/security_center/static/8388.php · Aviso do Fabricante