CVE-2000-0071

published 2000-01-11

CVE-2000-0071: IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.

Priority P2 69 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

ITW VulnCheck KEV

IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

snort

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .idq attempt"; flow:established,to_server; http.uri; content:".idq?"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:bugtraq,968; reference:cve,2000-0071; reference:cve,2000-0126; reference:nessus,10115; classtype:web-application-attack; sid:2101244; rev:18; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

snort

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .ida attempt"; flow:established,to_server; http.uri; content:".ida?"; nocase; reference:arachnids,552; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-attack; sid:2101243; rev:15; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

snort

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .idq access"; flow:established,to_server; http.uri; content:".idq"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-activity; sid:2101245; rev:14; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

snort

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .ida access"; flow:established,to_server; http.uri; content:".ida"; nocase; endswith; reference:arachnids,552; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-activity; sid:2101242; rev:15; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

• → Requests for non-existent files with .idq or .ida extensions (especially with query strings, e.g. '.idq?' or '.ida?') against IIS 4.0 servers are indicative of CVE-2000-0071 path disclosure exploitation attempts. ↗
• → Monitor inbound HTTP URI content for '.idq?' (with query string) as a higher-confidence attack indicator (classtype: web-application-attack), versus bare '.idq' which is a lower-confidence access indicator (classtype: web-application-activity).
• → Monitor inbound HTTP URI content for '.ida?' (with query string) as a higher-confidence attack indicator, versus bare '.ida' (endswith) which is a lower-confidence access indicator.

• · The four Snort rules use different classtypes: 'web-application-attack' (sids 2101243, 2101244) for query-string variants and 'web-application-activity' (sids 2101242, 2101245) for bare extension matches. Tune alerting thresholds accordingly to avoid alert fatigue from legitimate ISAPI access.
• · The .idq attempt rule (sid:2101244) cross-references CVE-2000-0126 in addition to CVE-2000-0071, indicating overlapping coverage; ensure both CVEs are tracked when triaging alerts from this rule.

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vulncheck 5.0 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.