CVE-2000-0649
published 2000-07-13CVE-2000-0649: IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic…
PriorityP421low2.6CVSS 2.0
AVNACHAuNCPINAN
EXPLOIT
EPSS
76.56%
99.5th percentile
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_server | — | — |
| microsoft | internet_information_server | — | — |
| microsoft | internet_information_services | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP 1.0 requests to Basic-auth protected resources with no realm defined; IIS responds with a 401 containing 'WWW-Authenticate: Basic realm=""' (empty realm), which leaks the internal IP in the response body. ↗
- →Monitor for HTTP PROPFIND requests to IIS servers; the response HREF header may disclose the internal IP address. ↗
- →Monitor for HTTP WRITE and MKCOL method requests against IIS, which may also expose the internal IP address. ↗
- →Detect HTTP requests made with an empty Host header to IIS servers, which can trigger internal IP disclosure. ↗
- →On IIS 7+, internal IP disclosure via this CVE occurs when the alternateHostName is not set or misconfigured; detection should cover modern IIS versions, not just IIS 4.0/5.x. ↗
- ·The vulnerability affects IIS even when placed behind a firewall or NAT; the true internal IP is still disclosed in the 401 response regardless of network topology. ↗
- ·Scope is broader than originally documented; the Metasploit module covers IIS 2.0 through 5.1 for CVE-2000-0649, but also targets IIS 7+ via misconfigured alternateHostName and PROPFIND leakage. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
exploitdb·2010-04-30
CVE-2002-0649 Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
---
##
# $Id: ms02_039_slammer.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft SQL Server Resolution Overflow',
'Description' => %q{
This is an exploit for the SQL Server 2000 resolution
service buffer overflow. This overflow is triggered by
sending a udp packet to port 1434 which starts with 0x04 and
is followed by long string terminating with a colon and a
number. This module should work against any vulnerable SQL
Server 2000
Exploit-DB
Microsoft SQL Server 2000 - Resolution Service Heap Overflow
exploitdb·2002-07-25
CVE-2002-0649 Microsoft SQL Server 2000 - Resolution Service Heap Overflow
Microsoft SQL Server 2000 - Resolution Service Heap Overflow
---
source: https://www.securityfocus.com/bid/5310/info
A vulnerability in Microsoft SQL Server 2000 could allow remote attackers to access target hosts.
A problem in the SQL Server Resolution Service allows a remote attacker to execute arbitrary code on a vulnerable host. The attacker could exploit a heap-based buffer overflow in the resolution service by sending a maliciously crafted UDP packet to port 1434.
***UPDATE:
A worm that may exploit this vulnerability has been detected in the wild.
Administrators are advised to:
- Block all external access to database servers until more information is available.
- Deny access to TCP and UDP ports 1434 completely
- Implement filter rules for other ports to decrease the chances
Exploit-DB
Microsoft IIS 2.0/3.0/4.0/5.0/5.1 - Internal IP Address Disclosure
exploitdb·2000-07-13
CVE-2000-0649 Microsoft IIS 2.0/3.0/4.0/5.0/5.1 - Internal IP Address Disclosure
Microsoft IIS 2.0/3.0/4.0/5.0/5.1 - Internal IP Address Disclosure
---
source: https://www.securityfocus.com/bid/1499/info
When a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 1.0, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host. Even if IIS is behind a firewall or NAT, it will disclose the true internal IP address to the remote user.
The internal IP address may also be revealed through a HTTP request made with an empty host name. If a PROPFIND HTTP request is made, the message returned will include the IP address as part of the HREF header. The IP address may also be exposed through the WRITE or MKCOL methods, although they would not normally be exposed to th
Metasploit
Microsoft IIS HTTP Internal IP Disclosure
metasploit·CVSS 2.6
CVE-2000-0649 [LOW] Microsoft IIS HTTP Internal IP Disclosure
Microsoft IIS HTTP Internal IP Disclosure
Collect any leaked internal IPs by requesting commonly redirected locations from IIS. CVE-2000-0649 references IIS 5.1 (win2k, XP) and older. However, in newer servers such as IIS 7+, this occurs when the alternateHostName is not set or misconfigured. Also collects internal IPs leaked from the PROPFIND method in certain IIS versions.
No writeups or analysis indexed.
2000-07-13
Published