Alert: MS Index Server (CISADV000330)

Cerberus Information Security Advisory CISADV000330 http://www.cerberus-infosec.co.uk/advisories.shtml Released : 30th March 2000 Name : Index Server Strike 3! Affected Systems : Microsoft Internet Information Server Issue : Attackers can gain source of ASP and other pages Author : David Litchfie...

Еще одна уязвимость в MS Index Server

С помощью запроса типа http://charon/null.htw?CiWebHitsFile=/default.asp20&CiRestriction=none&CiHiliteType=Full можно получить исходный текст .asp или любого другого скрипта...

CVE-2000-0302

Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the CiWebHitsFile argument to the null.htw URL...

Security Bulletin (MS00-006)

Microsoft Security Bulletin MS00-006 - -------------------------------------- Patch Available for "Malformed Hit-Highlighting Argument" Vulnerability Originally Posted: January 26, 2000 Revised March 31, 2000 Summary ======= On January 26, 2000 Microsoft released the original version of this...

Microsoft Index Server 2.0 - %20 ASP Source Disclosure

Microsoft Index Server 2.0 - %20 ASP Source Disclosure source: https://www.securityfocus.com/bid/1084/info Index Server can be used to cause IIS to display the source of .asp and possibly other server-side processed files. By appending a space %20 to the end of the filename specified in the...

Microsoft Index Server 2.0 - '%20' ASP Source Disclosure

source: https://www.securityfocus.com/bid/1084/info Index Server can be used to cause IIS to display the source of .asp and possibly other server-side processed files. By appending a space %20 to the end of the filename specified in the 'CiWebHitsFile' variable, and setting 'CiHiliteType' to 'Ful...

CVE-2000-0097

The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vulnerability...

CVE-2000-0098

Microsoft Index Server allows remote attackers to determine the real path for a web directory via a request to an Internet Data Query file that does not exist...

CVE-2000-0098

CVE-2000-0098 describes a path-disclosure vulnerability in Microsoft Index Server/IIS WebHits: remote attackers can determine the real path of a web directory by requesting non-existent Internet Data Query files. OpenVAS notes the issue in MS00-006 (WebHits ISAPI filter) and IDA/IDQ path disclosu...

CVE-2000-0097

The CVE-2000-0097 vulnerability concerns Microsoft IIS WebHits ISAPI Filter used with Microsoft Index Server. The OpenVAS Active Check entries reference MS00-06 and confirm that the WebHits filter allows remote attackers to read arbitrary files via crafted requests (Mal-formed Hit-Highlighting Ar...

CVE-2000-0097

The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vulnerability...

CVE-2000-0098

Microsoft Index Server allows remote attackers to determine the real path for a web directory via a request to an Internet Data Query file that does not exist...

Microsoft Index Server 2.0 Indexing Service (Windows 2000) - Directory Traversal

Microsoft Index Server 2.0 Indexing Service Windows 2000 - Directory Traversal // source: https://www.securityfocus.com/bid/950/info Index Server 2.0 is a utility included in the NT 4.0 Option Pack. The functionality provided by Index Service has been built into Windows 2000 as Indexing Services...

Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - Directory Traversal

// source: https://www.securityfocus.com/bid/950/info Index Server 2.0 is a utility included in the NT 4.0 Option Pack. The functionality provided by Index Service has been built into Windows 2000 as Indexing Services. When combined with IIS, Index Server and Indexing Services include the ability...

nt4.index.server.2.0.txt

Date: Tue, 23 Mar 1999 23:40:55 -0000 From: Mnemonix To: [email protected] Subject: Index Server 2.0 and the Registry When Microsoft's Index Server 2.0 is installed on NT 4 with Internet Information Server 4 it opens a new "AllowedPath" into the Windows NT Registry. Administrators...

CVE-1999-1397

Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed...