PT-1999-1834 · Microsoft · Iis+1

Published 1999-12-21 · Updated 2018-10-12 · CVE-2000-0025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IIS versions 4.0 Site Server versions 3.0

Description: The issue allows remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes certain extensions.

Recommendations: For IIS version 4.0, rename virtual directories to avoid using extensions such as .com, .exe, .sh, .cgi, or .dll. For Site Server version 3.0, rename virtual directories to avoid using extensions such as .com, .exe, .sh, .cgi, or .dll.

Fix

Related Identifiers

CVE-2000-0025

Affected Products

Iis

Site Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2000-0025 · Security Note
• http://osvdb.org/8098 · Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-058 · Note
• http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ238606 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0025 · Note