PT-1999-1770 · Microsoft · Iis

Published 1999-07-07 · Updated 2017-10-10 · CVE-1999-1537

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: IIS versions 3.x through 4.x

Description: The issue allows remote attackers to cause a denial of service, specifically resource exhaustion, by sending SSL requests to the HTTPS port for files that normally do not require encryption. This causes the software to perform extra work to send these files over SSL.

Recommendations: For IIS versions 3.x through 4.x, consider restricting access to the HTTPS port for files that do not require encryption as a temporary workaround to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-1999-1537

Affected Products

Iis

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-1999-1537 · Security Note
• http://securityfocus.com/bid/521 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1537 · Note
• http://marc.info/?l=ntbugtraq&m=93138827329577&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/2352 · Note