DoS против IIS через FrontPage Server Extensions (Web Form Submission)

Определенный запрос к FPSE приводит к кразу IIS...

CVE-2000-1147

CVE-2000-1147 describes a buffer overflow in the IIS ISAPI .ASP parsing mechanism, enabling attackers to execute arbitrary commands by sending a long string in the LANGUAGE argument of a script tag. The vulnerability is categorized with a MEDIUM base score (CVSS v2.0: AV:L/AC:L/Au:N/C:P/I:P/A:P) ...

CVE-2000-1147

Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands via a long string to the "LANGUAGE" argument in a script tag...

CVE-2000-0884

IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability...

CVE-2000-1104

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 CVE-2000-0746 allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those...

CVE-2000-0886

IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability...

CVE-2000-0970

IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability...

CVE-2000-0951

A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and Versioning WebDAV search...

EUVD-2000-1089

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 CVE-2000-0746 allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those...

Microsoft IIS Multiple .cnf File Information Disclosure

The IIS web server may allow a remote user to retrieve its installation path via GET requests to the files 'access.cnf', 'botinfs.cnf', 'bots.cnf' or 'linkinfo.cnf' in the '/vtipvt' directory. This is not the default configuration. %NASLMINLEVEL 70300 This script was written by John Lampe...

Microsoft IIS bdir.htr Arbitrary Directory Listing

The file bdir.htr is a default IIS files which can give a malicious user a lot of unnecessary information about your file system. Specifically, the 'bdir.htr' script allows the user to browser and create files on hard drive. As this includes critical system files, it is highly possible that the...

Microsoft IIS / Site Server viewcode.asp Arbitrary File Access

The file viewcode.asp is a default IIS file that can give a malicious user a lot of unnecessary information about your file system or source files. Specifically, viewcode.asp can allow a remote user to potentially read any file on a web server hard drive. %NASLMINLEVEL 70300 This script was writt...

Microsoft IIS Phone Book Service /pbserver/pbserver.dll Remote Overflow

The CGI /pbserver/pbserver.dll is subject to a buffer overflow attack that may allow an attacker to execute arbitrary commands on this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10564; scriptversion"1.43...

@stake Advisory: IIS 4.0/5.0 Phone Book server buffer overrun (A120400-1)

@stake, Inc. www.atstake.com Security Advisory Advisory Name: IIS 4.0/5.0 Phone Book server buffer overrun Release Date: 12/04/2000 Application: Microsoft's Phone Book Server on IIS 4.0, 5.0 Platform: Windows NT 4.0, Windows 2000 Severity: A buffer overflow conditions exists in pbserver.dll that...

Microsoft Windows NT 4.0 - Phonebook Server Buffer Overflow

Microsoft Windows NT 4.0 - Phonebook Server Buffer Overflow source: https://www.securityfocus.com/bid/2048/info The Phone Book Service is an optional component that ships with the NT 4 Option Pack and Windows 2000. It is not installed by default. A buffer overflow vulnerability was discovered in...

Дырка в IIS (File Request Parsing)

При разборе имени запрашиваемого CGI, можно выполнить приложение .bat или .cmd за счет исопльзования специальных метасимволов...

Re-release: Microsoft Security Bulletin MS00-086

============================================================ Issue: Regression error in IIS 5.0 patch re-exposes previous vulnerability. Date: November 30, 2000 Affected Software: IIS 5.0 Impact: Execute system commands on server Bulletin ID: MS00-086 Bulletin:...

IIS 5.0 with patch Q277873 allows executing arbitrary commands on the web server

A recent report http://www.securityfocus.com/archive/1/147109 suggests that; http://IISServer/scripts/somefile.bat/..C19C..C19C..C19Cwinnt/system32 /cmd.exe?/c20dir20C: wrapped might yield a directory listing on IIS 5.0 boxes that have applied the fix listed in Microsoft Security Bulletin MS00-08...

Possible problems with patch for MS00-086

A recent report http://www.securityfocus.com/archive/1/147109 suggests that; http://IISServer/scripts/somefile.bat/..C19C..C19C..C19Cwinnt/system32 /cmd.exe?/c20dir20C: wrapped might yield a directory listing on IIS 5.0 boxes that have applied the fix listed in Microsoft Security Bulletin MS00-08...

[Update] NSFOCUS SA2000-07: Microsoft IIS 4.0/5.0 CGI File Name Inspection Vulnerability

NSFOCUS Security AdvisorySA2000-07 Topic: Microsoft IIS 4.0/5.0 CGI File Name Inspection Vulnerability Release DateЈє Nov 7th, 2000 Update DateЈє Nov 23rd, 2000 CVE Candidate Numbers: CAN-2000-0886 BUGTRAQ ID : 1912 Affected system: ================ - Microsoft IIS 4.0 - Microsoft IIS 5.0 Impact:...