|
Microsoft IIS "500-100.asp" Source Code Disclosure
|
|
Secunia Advisory:
|
SA16548
|
|
|
Release Date:
|
2005-08-23
|
|
Last Update:
|
2005-09-08
|
|
Popularity:
|
15,834 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Workaround
|
|
| Software: | Microsoft Internet Information Services (IIS) 5.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-2678
|
|
Description:
Inge Henriksen has discovered a vulnerability in Microsoft Internet Information Services (IIS), which can be exploited by malicious people to gain knowledge of potentially sensitive information.
The vulnerability is caused due the "500-100.asp" script making assumptions based on the user-controlled "SERVER_NAME" variable. This can be exploited to gain knowledge of script contents when an error is encountered via a specially crafted HTTP request.
The vulnerability has been confirmed in IIS 5.1 and has also been reported in version 5.0. Version 6.0 is reportedly not affected.
Solution:
The vendor recommends modifying the 500-100.asp error page manually, or removing the "All Unassigned" binding for all sites and specify required host names (see KB906910 for details).
Provided and/or discovered by:
Inge Henriksen
Changelog:
2005-08-24: Updated advisory.
2005-08-25: Added CVE reference.
2005-09-08: Removed version 6.0 as affected, added link to KB906910 and updated "Solution" section.
Original Advisory:
http://ingehenriksen.blogspot.com/200...te-iis-5x-and-iis-60-server-name.html
Microsoft (KB906910):
http://support.microsoft.com/kb/906910
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
