Sign-up

ID

VAR-199908-0015


CVE

CVE-1999-0725


TITLE

Microsoft IIS 3.0/4.0"%81"ASP Source leak vulnerability (MS99-022)

Trust: 0.6

sources: CNNVD: CNNVD-199908-032

DESCRIPTION

When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a. "Double Byte Code Page". How this works is as follows: IIS checks the extension of the requested file to see if it needs to do any processing before delivering the information. If the requested extension is not on it's list, it then makes any language-based calculations, and delivers the file. If a single byte is appended to the end of the URL when IIS to set to use one of the double-byte language packs (Chinese, Japanese, or Korean) the language module will strip it as invalid, then look for the file. Since the new URL now points to a valid filename, and IIS has already determined that this transaction requires no processing, the file is simply delivered as is, exposing the source code

Trust: 1.17

sources: NVD: CVE-1999-0725 // BID: 477

AFFECTED PRODUCTS

vendor:microsoftmodel:internet information serverscope:eqversion:4.0

Trust: 1.6

vendor:microsoftmodel:internet information serverscope:eqversion:3.0

Trust: 1.6

vendor:microsoftmodel:iisscope:eqversion:4.0

Trust: 0.3

vendor:microsoftmodel:iisscope:eqversion:3.0

Trust: 0.3

vendor:microsoftmodel:iisscope:neversion:2.0

Trust: 0.3

sources: BID: 477 // CNNVD: CNNVD-199908-032 // NVD: CVE-1999-0725

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-1999-0725
value: HIGH

Trust: 1.0

CNNVD: CNNVD-199908-032
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-1999-0725
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

sources: CNNVD: CNNVD-199908-032 // NVD: CVE-1999-0725

PROBLEMTYPE DATA

problemtype:CWE-16

Trust: 1.0

sources: NVD: CVE-1999-0725

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-199908-032

TYPE

configuration error

Trust: 0.6

sources: CNNVD: CNNVD-199908-032

EXTERNAL IDS

db:BIDid:477

Trust: 1.9

db:NVDid:CVE-1999-0725

Trust: 1.6

db:MSKBid:Q233335

Trust: 0.6

db:MSid:MS99-022

Trust: 0.6

db:NSFOCUSid:3425

Trust: 0.6

db:XFid:2302

Trust: 0.6

db:CNNVDid:CNNVD-199908-032

Trust: 0.6

sources: BID: 477 // CNNVD: CNNVD-199908-032 // NVD: CVE-1999-0725

REFERENCES

url:http://www.securityfocus.com/bid/477

Trust: 1.6

url:http://support.microsoft.com/default.aspx?scid=kb%3b%5bln%5d%3bq233335

Trust: 1.0

url:https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-022

Trust: 1.0

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/2302

Trust: 1.0

url:http://xforce.iss.net/xforce/xfdb/2302

Trust: 0.6

url:http://www.microsoft.com/technet/security/bulletin/ms99-022.mspx

Trust: 0.6

url:http://support.microsoft.com/default.aspx?scid=kb;%5bln%5d;q233335

Trust: 0.6

url:http://www.nsfocus.net/vulndb/3425

Trust: 0.6

url:http://www.microsoft.com/technet/security/bulletin/fq99-022.asp

Trust: 0.3

url:http://support.microsoft.com/support/kb/articles/q233/3/35.asp

Trust: 0.3

sources: BID: 477 // CNNVD: CNNVD-199908-032 // NVD: CVE-1999-0725

CREDITS

Microsoft Security Bulletin

Trust: 0.6

sources: CNNVD: CNNVD-199908-032

SOURCES

db:BIDid:477
db:CNNVDid:CNNVD-199908-032
db:NVDid:CVE-1999-0725

LAST UPDATE DATE

2024-08-14T13:51:37.098000+00:00


SOURCES UPDATE DATE

db:BIDid:477date:1999-06-24T00:00:00
db:CNNVDid:CNNVD-199908-032date:2005-10-12T00:00:00
db:NVDid:CVE-1999-0725date:2023-11-07T01:55:01.693

SOURCES RELEASE DATE

db:BIDid:477date:1999-06-24T00:00:00
db:CNNVDid:CNNVD-199908-032date:1999-06-24T00:00:00
db:NVDid:CVE-1999-0725date:1999-08-19T04:00:00