Sign-up

ID

VAR-200212-0570


CVE

CVE-2002-1694


TITLE

Microsoft IIS of Vulnerability of modifying log files in default settings

Trust: 0.8

sources: JVNDB: JVNDB-2002-000011

DESCRIPTION

Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running. Unprivileged users could modify the log file using a File Open Dialog with Win32 API call. The following are the default permissions on the log files folder: Administrators: Full Control Everyone: Change (RWXD) IUSR_ ComputerName : Full Control System: Full Control

Trust: 1.89

sources: NVD: CVE-2002-1694 // JVNDB: JVNDB-2002-000011 // BID: 3888

AFFECTED PRODUCTS

vendor:microsoftmodel:internet information serverscope:eqversion:4.0

Trust: 1.6

vendor:microsoftmodel:internet information servicesscope:eqversion:5.0

Trust: 1.6

vendor:microsoftmodel:iisscope:eqversion:4.0

Trust: 1.1

vendor:microsoftmodel:internet information serverscope:eqversion:5.0

Trust: 0.6

vendor:symantecmodel:norton internet securityscope:eqversion:20010

Trust: 0.3

vendor:microsoftmodel:iisscope:eqversion:5.0

Trust: 0.3

sources: BID: 3888 // JVNDB: JVNDB-2002-000011 // CNNVD: CNNVD-200212-079 // NVD: CVE-2002-1694

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2002-1694
value: MEDIUM

Trust: 1.0

NVD: CVE-2002-1694
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200212-079
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2002-1694
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2002-000011 // CNNVD: CNNVD-200212-079 // NVD: CVE-2002-1694

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2002-1694

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200212-079

TYPE

Design Error

Trust: 0.9

sources: BID: 3888 // CNNVD: CNNVD-200212-079

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2002-000011

PATCH
title:Top Pageurl:http://www.microsoft.com/ja/jp/default.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2002-000011

EXTERNAL IDS
db:BIDid:3888
Trust: 2.7
db:NVDid:CVE-2002-1694
Trust: 2.4
db:JVNDBid:JVNDB-2002-000011
Trust: 0.8
db:NSFOCUSid:2160
Trust: 0.6
db:XFid:7919
Trust: 0.6
db:CNNVDid:CNNVD-200212-079
Trust: 0.6
sources:
            
            
            BID: 3888 // 
            
            
            
            JVNDB: JVNDB-2002-000011 // 
            
            
            
            CNNVD: CNNVD-200212-079 // 
            
            
            
            NVD: CVE-2002-1694

REFERENCES
url:http://www.securityfocus.com/bid/3888
Trust: 3.4
url:http://online.securityfocus.com/archive/1/250591
Trust: 2.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/7919
Trust: 2.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-1694
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-1694
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/7919
Trust: 0.6
url:http://www.nsfocus.net/vulndb/2160
Trust: 0.6
url:http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/iis4cl.asp
Trust: 0.3
url:http://www.microsoft.com/technet/security
Trust: 0.3
url:http://www.symantec.com/sabu/nis/nis_pe/
Trust: 0.3
url:http://support.microsoft.com/default.aspx?scid=kb;en-us;q315986
Trust: 0.3
sources:
            
            
            BID: 3888 // 
            
            
            
            JVNDB: JVNDB-2002-000011 // 
            
            
            
            CNNVD: CNNVD-200212-079 // 
            
            
            
            NVD: CVE-2002-1694

CREDITS
Information Anarchy 2K01※ advisories@nmrc.org
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200212-079

SOURCES
db:BIDid:3888
db:JVNDBid:JVNDB-2002-000011
db:CNNVDid:CNNVD-200212-079
db:NVDid:CVE-2002-1694

LAST UPDATE DATE
2024-11-22T22:48:44.643000+00:00

SOURCES UPDATE DATE
db:BIDid:3888date:2002-01-16T00:00:00
db:JVNDBid:JVNDB-2002-000011date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200212-079date:2005-10-20T00:00:00
db:NVDid:CVE-2002-1694date:2024-11-20T23:41:54.043

SOURCES RELEASE DATE
db:BIDid:3888date:2002-01-16T00:00:00
db:JVNDBid:JVNDB-2002-000011date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200212-079date:2002-01-16T00:00:00
db:NVDid:CVE-2002-1694date:2002-12-31T05:00:00