Details of VAR-200012-0155

ID

VAR-200012-0155

CVE

CVE-2000-0886

TITLE

Microsoft IIS Vulnerability in parsing of executable files

Trust: 0.8

sources: JVNDB: JVNDB-2000-000101

DESCRIPTION

IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability. Thus, a malicious user may perform system commands through cmd.exe under the context of the IUSR_machinename account which could possibly lead to privilege escalation, deletion, addition, and modification of files, or full compromise of the server. In order to establish successful exploitation, the file requested must be an existing .bat or .cmd file residing in a folder that the user possesses executable permissions to. Update (November 27, 2000): Georgi Guninski has discovered new variants of this vulnerability that have appeared after applying the patch (Q277873) supplied by Microsoft. Please see 'Exploit' for further details. Update (December 7, 2000): Billy Nothern has discovered that the commands can also be parsed through ActiveState Perl. Please see his Bugtraq posted located under 'Credit' for further information. **UPDATE**: It is believed that an aggressive worm may be in the wild that actively exploits this vulnerability

Trust: 1.89

sources: NVD: CVE-2000-0886 // JVNDB: JVNDB-2000-000101 // BID: 1912

AFFECTED PRODUCTS

vendor:	microsoft	model:	internet information server	scope:	eq	version:	4.0	Trust: 1.6
vendor:	microsoft	model:	internet information services	scope:	eq	version:	5.0	Trust: 1.6
vendor:	microsoft	model:	iis	scope:	eq	version:	5.0	Trust: 1.1
vendor:	microsoft	model:	iis	scope:	eq	version:	4.0 4.0	Trust: 0.8
vendor:	microsoft	model:	internet information server	scope:	eq	version:	5.0	Trust: 0.6
vendor:	microsoft	model:	iis	scope:	eq	version:	4.0	Trust: 0.3

sources: BID: 1912 // JVNDB: JVNDB-2000-000101 // CNNVD: CNNVD-200012-113 // NVD: CVE-2000-0886

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2000-0886
value:	HIGH
Trust: 1.0
NVD:	CVE-2000-0886
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200012-113
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2000-0886
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

sources: JVNDB: JVNDB-2000-000101 // CNNVD: CNNVD-200012-113 // NVD: CVE-2000-0886

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2000-0886

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200012-113

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-200012-113

CONFIGURATIONS

sources: JVNDB: JVNDB-2000-000101

PATCH

title:	MS00-086	url:	http://www.microsoft.com/technet/security/bulletin/ms00-086.mspx	Trust: 0.8
title:	MS00-086	url:	http://www.microsoft.com/japan/technet/security/Bulletin/ms00-086.mspx	Trust: 0.8

sources: JVNDB: JVNDB-2000-000101

EXTERNAL IDS

db:	BID	id:	1912	Trust: 2.7
db:	NVD	id:	CVE-2000-0886	Trust: 2.4
db:	JVNDB	id:	JVNDB-2000-000101	Trust: 0.8
db:	OVAL	id:	OVAL:ORG.MITRE.OVAL:DEF:191	Trust: 0.6
db:	MS	id:	MS00-086	Trust: 0.6
db:	BUGTRAQ	id:	20001107 NSFOCUS SA2000-07 : MICROSOFT IIS 4.0/5.0 CGI FILE NAME INSPECTION VULNERABILITY	Trust: 0.6
db:	XF	id:	5470	Trust: 0.6
db:	CNNVD	id:	CNNVD-200012-113	Trust: 0.6

sources: BID: 1912 // JVNDB: JVNDB-2000-000101 // CNNVD: CNNVD-200012-113 // NVD: CVE-2000-0886

REFERENCES

url:	http://www.securityfocus.com/bid/1912	Trust: 2.4
url:	http://www.securityfocus.com/templates/archive.pike?mid=143604&list=1&fromthread=0&end=2000-11-11&threads=0&start=2000-11-05&	Trust: 1.6
url:	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-086	Trust: 1.0
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/5470	Trust: 1.0
url:	https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a191	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2000-0886	Trust: 0.8
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2000-0886	Trust: 0.8
url:	http://www.microsoft.com/technet/security/bulletin/ms00-086.asp	Trust: 0.6
url:	http://xforce.iss.net/xforce/xfdb/5470	Trust: 0.6
url:	http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:191	Trust: 0.6
url:	http://www.microsoft.com/technet/security/bulletin/fq00-086.asp	Trust: 0.3
url:	http://www.microsoft.com/technet/support/kb.asp?id=277873	Trust: 0.3

sources: BID: 1912 // JVNDB: JVNDB-2000-000101 // CNNVD: CNNVD-200012-113 // NVD: CVE-2000-0886

CREDITS

Discovered by NSFocus <security@nsfocus.com> and publicized in a Microsoft Security Bulletin (MS00-086) on November 6, 2000. The new variants of this vulnerability was discovered by Georgi Guninski <guninski@guninski.com> on November 27, 2000 and Billy N

Trust: 0.6

sources: CNNVD: CNNVD-200012-113

SOURCES

db:	BID	id:	1912
db:	JVNDB	id:	JVNDB-2000-000101
db:	CNNVD	id:	CNNVD-200012-113
db:	NVD	id:	CVE-2000-0886

LAST UPDATE DATE

2024-08-14T14:42:26.417000+00:00

SOURCES UPDATE DATE

db:	BID	id:	1912	date:	2000-11-06T00:00:00
db:	JVNDB	id:	JVNDB-2000-000101	date:	2007-04-01T00:00:00
db:	CNNVD	id:	CNNVD-200012-113	date:	2005-10-12T00:00:00
db:	NVD	id:	CVE-2000-0886	date:	2018-10-30T16:25:10.357

SOURCES RELEASE DATE

db:	BID	id:	1912	date:	2000-11-06T00:00:00
db:	JVNDB	id:	JVNDB-2000-000101	date:	2007-04-01T00:00:00
db:	CNNVD	id:	CNNVD-200012-113	date:	2000-12-19T00:00:00
db:	NVD	id:	CVE-2000-0886	date:	2000-12-19T05:00:00