Microsoft Internet Information Services vulnerabilities

CVE-2001-1243 [MEDIUM] CVE-2001-1243: Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

CVE-2001-0151 [MEDIUM] CVE-2001-0151: IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV reques IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.

CVE-2001-0146 [MEDIUM] CVE-2001-0146: IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allo IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.

CVE-2001-0096 [MEDIUM] CVE-2001-0096: FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of s FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission" vulnerability.

CVE-2001-0004 [MEDIUM] CVE-2001-0004: IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs b IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.

CVE-2000-1104 [HIGH] CVE-2000-1104: Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE- Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site.

CVE-2000-0884 [HIGH] CVE-2000-0884: IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly exec IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.

CVE-2000-0886 [HIGH] CVE-2000-0886: IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executa IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability.

CVE-2000-0970 [HIGH] CVE-2000-0970: IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, whi IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

CVE-2000-0951 [MEDIUM] CVE-2000-0951: A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote att A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and Versioning (WebDAV) search.

CVE-2000-0746 [HIGH] CVE-2000-0746: Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attack Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross

CVE-2000-0778 [MEDIUM] CVE-2000-0778: IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP G IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability.

CVE-2000-0770 [MEDIUM] CVE-2000-0770: IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folder IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to bypass access restrictions to some files, aka the "File Permission Canonicalization" vulnerability.

CVE-2000-0630 [MEDIUM] CVE-2000-0630: IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to t IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability.

CVE-2000-0631 [MEDIUM] CVE-2000-0631: An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to cause a denial of service by accessing the script without a particular argument, aka the "Absent Directory Browser Argument" vulnerability.

CVE-2000-0649 [LOW] CWE-200 CVE-2000-0649: IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 requ IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

CVE-2000-0457 [HIGH] CVE-2000-0457: ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability.

CVE-2000-0408 [MEDIUM] CVE-2000-0408: IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that ap IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the "Malformed Extension Data in URL" vulnerability.

CVE-2000-0304 [MEDIUM] CVE-2000-0304: Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to cause a denial of service via a malformed request to the inetinfo.exe program, aka the "Undelimited .HTR Request" vulnerability.

CVE-2000-0413 [MEDIUM] CVE-2000-0413: The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.