CVE-2000-0126: Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack.

PriorityP424medium5CVSS 2.0

AVNACLAuNCPINAN

EXPLOIT

EPSS

45.66%

98.6th percentile

Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_server	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/query.idq?CiTemplate=../../../somefile.ext↗

filenameidq.dll↗

filenamewebhits.dll↗

snort

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .idq attempt"; flow:established,to_server; http.uri; content:".idq?"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:bugtraq,968; reference:cve,2000-0071; reference:cve,2000-0126; reference:nessus,10115; classtype:web-application-attack; sid:2101244; rev:18; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

→Detect directory traversal via the CiTemplate parameter in .idq requests; look for '../' sequences in the URI query string targeting idq.dll. ↗
→Detect extension-bypass technique: attacker appends multiple URL-encoded spaces (%20) before .htx to push the extension out of the buffer. Look for patterns like 'filename.txt%20%20%20...%20%20.htx' in .idq CiTemplate parameters. ↗
→Alert on any HTTP request URI containing '.idq?' directed at IIS servers, as this is the primary attack vector for this CVE.

·Exploitation requires the attacker to know the physical path and filename of the target file, and the ACL must grant read access to the anonymous user, Everyone, or Guest group. ↗
·If the MS00-006 (webhits.dll) patch has been applied, IDQ files are only vulnerable if they do NOT append the .htx extension to user input — the extension-bypass technique is then the relevant attack path. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

GPL EXPLOIT ISAPI .idq attempt

suricata·2010-09-23

CVE-2000-0071 GPL EXPLOIT ISAPI .idq attempt GPL EXPLOIT ISAPI .idq attempt Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .idq attempt"; flow:established,to_server; http.uri; content:".idq?"; nocase; reference:arachnids,553; reference:bugtraq,1065; reference:bugtraq,968; reference:cve,2000-0071; reference:cve,2000-0126; reference:nessus,10115; classtype:web-application-attack; sid:2101244; rev:18; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL FTP CWD overflow attempt

suricata·2010-09-23

CVE-1999-0219 GPL FTP CWD overflow attempt GPL FTP CWD overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP CWD overflow attempt"; flow:established,to_server; content:"CWD"; nocase; isdataat:100,relative; pcre:"/^CWD\s[^\n]{100}/smi"; reference:bugtraq,11069; reference:bugtraq,1227; reference:bugtraq,1690; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7950; reference:cve,1999-0219; reference:cve,1999-1058; reference:cve,1999-1510; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0781; reference:cve,2002-0126; reference:cve,2002-0405; classtype:attempted-admin; sid:2101919; rev:25; metadata:created_at 2010_09_23, cve CVE_1999_0219, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL FTP PASS overflow attempt

suricata·2010-09-23

CVE-1999-1519 GPL FTP PASS overflow attempt GPL FTP PASS overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP PASS overflow attempt"; flow:established,to_server,no_stream; content:"PASS"; nocase; isdataat:100,relative; pcre:"/^PASS\s[^\n]{100}/smi"; reference:bugtraq,10078; reference:bugtraq,10720; reference:bugtraq,1690; reference:bugtraq,3884; reference:bugtraq,8601; reference:bugtraq,9285; reference:cve,1999-1519; reference:cve,1999-1539; reference:cve,2000-1035; reference:cve,2002-0126; reference:cve,2002-0895; classtype:attempted-admin; sid:2101972; rev:19; metadata:created_at 2010_09_23, cve CVE_1999_1519, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL FTP USER overflow attempt

suricata·2010-09-23

CVE-1999-1510 GPL FTP USER overflow attempt GPL FTP USER overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP USER overflow attempt"; flow:established,to_server,no_stream; content:"USER|20|"; nocase; isdataat:100,relative; pcre:"/^USER\x20[^\x00\x20\x0a\x0d]{100}/smi"; reference:bugtraq,10078; reference:bugtraq,1227; reference:bugtraq,1504; reference:bugtraq,1690; reference:bugtraq,4638; reference:bugtraq,7307; reference:bugtraq,8376; reference:cve,1999-1510; reference:cve,1999-1514; reference:cve,1999-1519; reference:cve,1999-1539; reference:cve,2000-0479; reference:cve,2000-0656; reference:cve,2000-0761; reference:cve,2000-0943; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0256; reference:cve,2001-0794; reference:cve,2001-0826; reference:cve,2002-0126; reference:cve,2002-1522;