PT-2010-1202 · Microsoft · Internet Information Services

Published 2010-02-05 · Updated 2019-07-03 · CVE-2003-1582

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Information Services (IIS) version 6.0

Description The issue allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response. This can be used to inject XSS sequences, and is related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Recommendations For Microsoft Internet Information Services (IIS) version 6.0, consider disabling DNS resolution for client IP addresses to prevent arbitrary text injection into log files until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2003-1582

Affected Products

Internet Information Services

References · 3

• 🔥 http://securityfocus.com/archive/1/313867 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1582 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1582 · Note