Details of VAR-200106-0117

ID

VAR-200106-0117

CVE

CVE-2001-0335

TITLE

Microsoft IIS FTP service searches all trusted domains for user accounts

Trust: 0.8

sources: CERT/CC: VU#137544

DESCRIPTION

FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a special sequence of characters. A user attempting to authenticate using a valid login name appended with specially chosen characters, will not be required to specify the domain which the account belongs. Once the account is located, the user will have to complete the authentication process. At this point brute force attacks can be used in an attempt to gain access to the domain

Trust: 3.6

sources: NVD: CVE-2001-0335 // CERT/CC: VU#137544 // CERT/CC: VU#573155 // JVNDB: JVNDB-2001-000069 // BID: 2847 // BID: 2719

AFFECTED PRODUCTS

vendor:	microsoft	model:	-	scope:	-	version:	-	Trust: 1.6
vendor:	microsoft	model:	iis	scope:	eq	version:	5.0	Trust: 1.1
vendor:	microsoft	model:	internet information server	scope:	lte	version:	5.0	Trust: 1.0
vendor:	microsoft	model:	iis	scope:	eq	version:	4.0 4.0	Trust: 0.8
vendor:	microsoft	model:	internet information server	scope:	eq	version:	5.0	Trust: 0.6
vendor:	microsoft	model:	windows server sp2	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows server sp1	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows server	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows professional sp2	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows professional sp1	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows professional	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows datacenter server sp2	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows datacenter server sp1	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows datacenter server	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows advanced server sp2	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows advanced server sp1	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	windows advanced server	scope:	eq	version:	2000	Trust: 0.3
vendor:	microsoft	model:	iis	scope:	eq	version:	4.0	Trust: 0.3

sources: CERT/CC: VU#137544 // CERT/CC: VU#573155 // BID: 2847 // BID: 2719 // JVNDB: JVNDB-2001-000069 // CNNVD: CNNVD-200106-152 // NVD: CVE-2001-0335

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2001-0335
value:	MEDIUM
Trust: 1.0
CARNEGIE MELLON:	VU#137544
value:	10.13
Trust: 0.8
CARNEGIE MELLON:	VU#573155
value:	10.13
Trust: 0.8
NVD:	CVE-2001-0335
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200106-152
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2001-0335
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

sources: CERT/CC: VU#137544 // CERT/CC: VU#573155 // JVNDB: JVNDB-2001-000069 // CNNVD: CNNVD-200106-152 // NVD: CVE-2001-0335

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2001-0335

THREAT TYPE

network

Trust: 0.6

sources: BID: 2847 // BID: 2719

TYPE

Input Validation Error

Trust: 0.6

sources: BID: 2847 // BID: 2719

CONFIGURATIONS

sources: JVNDB: JVNDB-2001-000069

PATCH

title:	MS01-026	url:	http://www.microsoft.com/technet/security/bulletin/MS01-026.mspx	Trust: 0.8
title:	MS01-026	url:	http://www.microsoft.com/japan/technet/security/bulletin/MS01-026.mspx	Trust: 0.8

sources: JVNDB: JVNDB-2001-000069

EXTERNAL IDS

db:	BID	id:	2719	Trust: 3.5
db:	NVD	id:	CVE-2001-0335	Trust: 2.4
db:	CERT/CC	id:	VU#573155	Trust: 1.6
db:	CERT/CC	id:	VU#137544	Trust: 1.6
db:	BID	id:	2847	Trust: 1.1
db:	JVNDB	id:	JVNDB-2001-000069	Trust: 0.8
db:	MS	id:	MS01-026	Trust: 0.6
db:	XF	id:	6545	Trust: 0.6
db:	CNNVD	id:	CNNVD-200106-152	Trust: 0.6

sources: CERT/CC: VU#137544 // CERT/CC: VU#573155 // BID: 2847 // BID: 2719 // JVNDB: JVNDB-2001-000069 // CNNVD: CNNVD-200106-152 // NVD: CVE-2001-0335

REFERENCES

url:	http://www.securityfocus.com/bid/2719	Trust: 3.2
url:	http://www.microsoft.com/technet/security/bulletin/ms01-026.asp	Trust: 1.4
url:	http://www.microsoft.com/technet/security/bulletin/ms01-031.asp	Trust: 1.1
url:	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026	Trust: 1.0
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/6545	Trust: 1.0
url:	http://www.kb.cert.org/vuls/id/573155	Trust: 0.8
url:	http://www.kb.cert.org/vuls/id/137544	Trust: 0.8
url:	http://www.microsoft.com/downloads/release.asp?releaseid=30508	Trust: 0.8
url:	http://www.securityfocus.com/bid/2847	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2001-0335	Trust: 0.8
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2001-0335	Trust: 0.8
url:	http://xforce.iss.net/static/6545.php	Trust: 0.6
url:	http://www.microsoft.com/technet/security/bulletin/ms02-026.asp	Trust: 0.3

sources: CERT/CC: VU#137544 // CERT/CC: VU#573155 // BID: 2847 // BID: 2719 // JVNDB: JVNDB-2001-000069 // CNNVD: CNNVD-200106-152 // NVD: CVE-2001-0335

CREDITS

Posted in a Microsoft Security Bulletin MS01-026 on May 14, 2001.

Trust: 0.9

sources: BID: 2719 // CNNVD: CNNVD-200106-152

SOURCES

db:	CERT/CC	id:	VU#137544
db:	CERT/CC	id:	VU#573155
db:	BID	id:	2847
db:	BID	id:	2719
db:	JVNDB	id:	JVNDB-2001-000069
db:	CNNVD	id:	CNNVD-200106-152
db:	NVD	id:	CVE-2001-0335

LAST UPDATE DATE

2024-08-14T12:59:39.951000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#137544	date:	2001-09-18T00:00:00
db:	CERT/CC	id:	VU#573155	date:	2001-09-18T00:00:00
db:	BID	id:	2847	date:	2001-06-07T00:00:00
db:	BID	id:	2719	date:	2001-05-14T00:00:00
db:	JVNDB	id:	JVNDB-2001-000069	date:	2007-04-01T00:00:00
db:	CNNVD	id:	CNNVD-200106-152	date:	2005-05-02T00:00:00
db:	NVD	id:	CVE-2001-0335	date:	2018-10-12T21:30:21.093

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#137544	date:	2001-09-18T00:00:00
db:	CERT/CC	id:	VU#573155	date:	2001-09-18T00:00:00
db:	BID	id:	2847	date:	2001-06-07T00:00:00
db:	BID	id:	2719	date:	2001-05-14T00:00:00
db:	JVNDB	id:	JVNDB-2001-000069	date:	2007-04-01T00:00:00
db:	CNNVD	id:	CNNVD-200106-152	date:	2001-06-27T00:00:00
db:	NVD	id:	CVE-2001-0335	date:	2001-06-27T04:00:00