CVE-2000-0778
published 2000-10-20CVE-2000-0778: IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the…
PriorityP335medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
86.41%
99.7th percentile
IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/global.asa
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER global.asa access"; flow:established,to_server; http.uri; content:"/global.asa"; nocase; reference:cve,2000-0778; reference:nessus,10491; reference:nessus,10991; classtype:web-application-activity; sid:2101016; rev:17; metadata:created_at 2010_09_23, cve CVE_2000_0778, signature_severity Unknown, updated_at 2024_03_08;)
- →Detect HTTP requests to IIS with a 'Translate: f' header combined with a trailing backslash or slash appended to the URL targeting scriptable file extensions (.asp, .asa, .htr, etc.) ↗
- →Alert on HTTP requests to /global.asa (case-insensitive) from external networks to HTTP servers, as this is a high-value target for source disclosure via this vulnerability
- ·The vulnerability requires both the 'Translate: f' header AND a trailing slash/backslash on the URL; either condition alone may not trigger source disclosure ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
GPL WEB_SERVER global.asa access
suricata·2010-09-23
CVE-2000-0778 GPL WEB_SERVER global.asa access
GPL WEB_SERVER global.asa access
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER global.asa access"; flow:established,to_server; http.uri; content:"/global.asa"; nocase; reference:cve,2000-0778; reference:nessus,10491; reference:nessus,10991; classtype:web-application-activity; sid:2101016; rev:17; metadata:created_at 2010_09_23, cve CVE_2000_0778, signature_severity Unknown, updated_at 2024_03_08;)
Exploit-DB
Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (2)
exploitdb·2000-08-14
CVE-2000-0778 Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (2)
Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (2)
---
source: https://www.securityfocus.com/bid/1578/info
Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server.
It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client.
Exploit-DB
Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (1)
exploitdb·2000-08-14
CVE-2000-0778 Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (1)
Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (1)
---
source: https://www.securityfocus.com/bid/1578/info
Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server.
It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client.
#
No writeups or analysis indexed.
http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0008&L=ntbugtraq&F=&S=&P=5212http://www.securityfocus.com/bid/1578http://www.securityfocus.com/templates/archive.pike?list=1&msg=080D5336D882D211B56B0060080F2CD696A7C9%40beta.mia.czhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-058https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A927http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0008&L=ntbugtraq&F=&S=&P=5212http://www.securityfocus.com/bid/1578http://www.securityfocus.com/templates/archive.pike?list=1&msg=080D5336D882D211B56B0060080F2CD696A7C9%40beta.mia.czhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-058https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A927
2000-10-20
Published