PT-2001-1131 · Microsoft · Iis

Published 2001-02-12 · Updated 2018-01-11 · CVE-2000-1090

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft IIS for Far East editions versions 4.0 through 5.0

Description The issue allows remote attackers to read source code for parsed pages via a malformed URL that uses the lead-byte of a double-byte character.

Recommendations For Microsoft IIS for Far East editions versions 4.0 through 5.0, consider restricting access to sensitive pages until a fix is available. As a temporary workaround, avoid using double-byte characters in URLs to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2000-1090

Affected Products

Iis

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2000-1090 · Security Note
• http://nsfocus.com/english/homepage/sa_08.htm · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5729 · Note
• http://securityfocus.com/bid/2100 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1090 · Note