PT-2002-1476 · Microsoft · Iis

Published 2002-06-11 · Updated 2020-11-23 · CVE-2002-0422

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IIS versions 5 and 5.1

Description The issue allows remote attackers to determine the internal IP address of the system via specific HTTP requests. This can be achieved through a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or via the WRITE or MKCOL method, which leaks the IP in the Location server header.

Recommendations For IIS versions 5 and 5.1, consider restricting access to WebDAV methods as a temporary workaround until a patch is available. Avoid using the PROPFIND, WRITE, or MKCOL methods in sensitive environments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2002-0422

Affected Products

Iis

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/iis_internal_ip.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/webdav_internal_ip.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0422 · Security Note
• http://marc.info/?l=bugtraq&m=101536634207324&w=2 · Note
• http://iss.net/security_center/static/8385.php · Note
• http://marc.info/?l=ntbugtraq&m=101535147125320&w=2 · Note
• http://osvdb.org/13431 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0422 · Note