PT-2010-1202 · Microsoft · Internet Information Services

Publicado 2010-02-05 · Atualizado 2019-07-03 · CVE-2003-1582

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Information Services (IIS) version 6.0

Description The issue allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response. This can be used to inject XSS sequences, and is related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Recommendations For Microsoft Internet Information Services (IIS) version 6.0, consider disabling DNS resolution for client IP addresses to prevent arbitrary text injection into log files until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2003-1582

Produtos afetados

Internet Information Services

Referências · 3

• 🔥 http://securityfocus.com/archive/1/313867 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1582 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1582 · Nota