PT-2009-1135 · Microsoft · Internet Information Services

Parcifal Aertssen · Publicado 2009-01-15 · Atualizado 2026-05-28 · CVE-2003-1567

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Information Services (IIS) version 5.0

Description The issue allows remote attackers to steal cookies and authentication credentials or bypass the HttpOnly protection mechanism. This is achieved by using the undocumented TRACK method to read the contents of the HTTP headers returned in the response, similar to cross-site tracing (XST) using HTTP TRACE.

Recommendations For Microsoft Internet Information Services (IIS) version 5.0, consider disabling the TRACK method to prevent exploitation until a patch is available. Restrict access to sensitive information and authentication credentials to minimize the risk of theft.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2003-1567

Produtos afetados

Internet Information Services

Referências · 7

• 🔥 http://aqtronix.com/Advisories/AQ-2003-02.txt · Exploit
• 🔥 http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0321.html · Exploit
• 🔥 http://osvdb.org/5648 · Exploit
• http://kb.cert.org/vuls/id/288308 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1567 · Nota de Segurança
• https://aqtronix.com/Advisories/AQ-2003-02.txt · Nota
• https://t.me/cveNotify/165089 · Publicação no Telegram