PT-1999-1702 · Microsoft · Iis 4.0+1

Published 1999-03-23 · Updated 2016-10-18 · CVE-1999-1397

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Index Server 2.0 on IIS 4.0

Description: The issue allows local and remote users to obtain the physical paths of directories that are being indexed, as the ContentIndexCatalogs subkey of the AllowedPaths registry key stores this information with permissions that are not restrictive enough.

Recommendations: For Index Server 2.0 on IIS 4.0, consider restricting access to the AllowedPaths registry key to prevent unauthorized users from obtaining physical path information. As a temporary workaround, restrict access to the ContentIndexCatalogs subkey to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-1999-1397

Affected Products

Iis 4.0

Index Server 2.0

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-1999-1397 · Security Note
• http://marc.info/?l=ntbugtraq&m=92223293409756&w=2 · Note
• http://marc.info/?l=bugtraq&m=92242671024118&w=2 · Note
• http://iss.net/security_center/static/7559.php · Note
• http://securityfocus.com/bid/476 · Note