PT-2000-1583 · Microsoft · Iis

Published 2000-07-13 · Updated 2020-11-23 · CVE-2000-0649

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IIS version 4.0

Description The issue allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

Recommendations For IIS version 4.0, define a realm for web pages protected by basic authentication to prevent disclosure of the internal IP address.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2000-0649

Affected Products

Iis

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/iis_internal_ip.rb · Exploit
• 🔥 https://github.com/rafaelh/CVE-2000-0649 · Exploit
• 🔥 https://exploit-db.com/exploits/20096 · Exploit
• 🔥 http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html · Exploit
• 🔥 http://securityfocus.com/bid/1499 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0649 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0649 · Note