Sign-up

ID

VAR-200212-0417


CVE

CVE-2002-1717


TITLE

Microsoft IIS System information disclosure vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2002-000027

DESCRIPTION

Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ Windows XP Shipped with by default Microsoft IIS 5.1 Has a problem that exposes detailed system information. IIS 5.1 Created by default installation of _vti_pvt Folder FrontPage Necessary when using. here Server Extensions There are various useful information, such as information such as page updates. this _vti_pvt The following in the folder .cnf File to remote attacker GET By sending a request, Web By revealing the structure and ownership of the site, the absolute path to each file, etc., there is a possibility that useful information will be taken for attackers who are conducting preliminary investigations on the host. < GET Files that disclose system information upon request> ・ ・ access.cnf ・ ・ botinfs.cnf ・ ・ bots.cnf ・ ・ linkinfo.cnf Also, as below /iishelp/common/colegal.htm about GET Sending a request could allow a remote attacker to access other files. GET /iishelp/common/colegal.htm:../../../../../_vti_bin/_vti_adm/admin.dll According to a further report, in order for this issue to be established, _vti_pvt The setting must allow read permission for the folder. Allegedly, submitting a request for one of the vulnerable files by way of '/_vti_pvt/', will cause the host to reveal system path information. The reported problematic files are 'access.cnf', 'botinfs.cnf', 'bots.cnf' and 'linkinfo.cnf'. Microsoft has not confirmed the existence of these vulnerabilities. * Confliciting details exist. This issue may be the result of a configuration error, although this has not been confirmed

Trust: 1.89

sources: NVD: CVE-2002-1717 // JVNDB: JVNDB-2002-000027 // BID: 4078

AFFECTED PRODUCTS

vendor:microsoftmodel:iisscope:eqversion:5.1

Trust: 1.1

vendor:microsoftmodel:internet information servicesscope:eqversion:5.1

Trust: 1.0

vendor:microsoftmodel:internet information serverscope:eqversion:5.1

Trust: 0.6

sources: BID: 4078 // JVNDB: JVNDB-2002-000027 // CNNVD: CNNVD-200212-797 // NVD: CVE-2002-1717

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2002-1717
value: MEDIUM

Trust: 1.0

NVD: CVE-2002-1717
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200212-797
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2002-1717
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2002-000027 // CNNVD: CNNVD-200212-797 // NVD: CVE-2002-1717

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.0

sources: NVD: CVE-2002-1717

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200212-797

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-200212-797

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2002-000027

PATCH
title:Top Pageurl:http://www.microsoft.com/ja/jp/default.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2002-000027

EXTERNAL IDS
db:BIDid:4078
Trust: 2.7
db:NVDid:CVE-2002-1717
Trust: 2.4
db:JVNDBid:JVNDB-2002-000027
Trust: 0.8
db:CNNVDid:CNNVD-200212-797
Trust: 0.6
sources:
            
            
            BID: 4078 // 
            
            
            
            JVNDB: JVNDB-2002-000027 // 
            
            
            
            CNNVD: CNNVD-200212-797 // 
            
            
            
            NVD: CVE-2002-1717

REFERENCES
url:http://www.securityfocus.com/bid/4078
Trust: 3.4
url:http://online.securityfocus.com/archive/1/255555
Trust: 2.6
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/8174
Trust: 2.6
url:http://online.securityfocus.com/archive/1/256125
Trust: 2.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-1717
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-1717
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2002-000027 // 
            
            
            
            CNNVD: CNNVD-200212-797 // 
            
            
            
            NVD: CVE-2002-1717

CREDITS
Discovered by Adonis.No.Spam <adonis1@videotron.ca>.
Trust: 0.9
sources:
            
            
            BID: 4078 // 
            
            
            
            CNNVD: CNNVD-200212-797

SOURCES
db:BIDid:4078
db:JVNDBid:JVNDB-2002-000027
db:CNNVDid:CNNVD-200212-797
db:NVDid:CVE-2002-1717

LAST UPDATE DATE
2024-11-22T23:10:06.129000+00:00

SOURCES UPDATE DATE
db:BIDid:4078date:2002-02-11T00:00:00
db:JVNDBid:JVNDB-2002-000027date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200212-797date:2020-12-10T00:00:00
db:NVDid:CVE-2002-1717date:2024-11-20T23:41:57.063

SOURCES RELEASE DATE
db:BIDid:4078date:2002-02-11T00:00:00
db:JVNDBid:JVNDB-2002-000027date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200212-797date:2002-12-31T00:00:00
db:NVDid:CVE-2002-1717date:2002-12-31T05:00:00