PT-2002-1475 · Microsoft · Iis

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0421

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IIS version 4.0

Description The issue allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling certain .htr password changing programs. These programs include aexp2.htr, aexp2b.htr, aexp3.htr, and aexp4.htr in the /iisadmpwd directory.

Recommendations For IIS version 4.0, consider restricting access to the /iisadmpwd directory and the specific .htr programs (aexp2.htr, aexp2b.htr, aexp3.htr, and aexp4.htr) to prevent unauthorized password changes.

Fix

Related Identifiers

CVE-2002-0421

Affected Products

Iis

References · 4

• http://online.securityfocus.com/archive/1/259963 · Vendor Advisory
• http://securityfocus.com/bid/4236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0421 · Security Note
• http://iss.net/security_center/static/8388.php · Vendor Advisory