PT-2003-2251 · Microsoft · Urlscan

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1306

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft URLScan version 2.5

Description The issue allows remote attackers to obtain sensitive information, including the server name and version, via specific HTTP requests that generate certain errors, such as a 400 "Bad Request" error, which can leak the Server header in the response.

Recommendations For Microsoft URLScan version 2.5, consider disabling the RemoveServerHeader option as a temporary workaround to minimize the risk of information leakage.

Exploit

Fix

Related Identifiers

CVE-2003-1306

Affected Products

Urlscan

References · 4

• 🔥 http://osvdb.org/29370 · Exploit
• 🔥 http://archives.neohapsis.com/archives/sf/www-mobile/2003-q3/0021.html · Exploit
• http://secunia.com/advisories/9194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1306 · Security Note