Sign-up

ID

VAR-200508-0061


CVE

CVE-2005-2678


TITLE

Microsoft IIS In SERVER_NAME Variable spoofing vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2005-000494

DESCRIPTION

Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from localhost. Microsoft IIS In SERVER_NAME Incorrect handling of variables HTTP A vulnerability exists in which a variable can be changed to an arbitrary value by sending a request.It is possible to obtain important information in the system. IIS Far East Edition is prone to a remote security vulnerability. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Microsoft IIS "SERVER_NAME" Variable Spoofing Vulnerability SECUNIA ADVISORY ID: SA16548 VERIFY ADVISORY: http://secunia.com/advisories/16548/ CRITICAL: Less critical IMPACT: Spoofing WHERE: >From remote SOFTWARE: Microsoft Internet Information Services (IIS) 5.x http://secunia.com/product/39/ Microsoft Internet Information Services (IIS) 6 http://secunia.com/product/1438/ DESCRIPTION: Inge Henriksen has discovered a vulnerability in Microsoft Internet Information Services (IIS), which can be exploited by malicious people to spoof certain information. The vulnerability is caused due to an error when determining the "SERVER_NAME" variable and can be exploited to spoof it via a specially crafted HTTP request. Successful exploitation may e.g. disclose parts of an ASP scripts' source code or make it possible to bypass security checks performed by a web application based on the "SERVER_NAME" variable. The vulnerability has been confirmed in IIS 5.1 and has also been reported in versions 5.0 and 6.0. SOLUTION: Don't make assumptions based on the "SERVER_NAME" variable in web applications. Don't use the default 500-100.asp error page, as it makes assumptions based on the "SERVER_NAME" variable and may return script contents when encountering errors. PROVIDED AND/OR DISCOVERED BY: Inge Henriksen ORIGINAL ADVISORY: http://ingehenriksen.blogspot.com/2005/08/remote-iis-5x-and-iis-60-server-name.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.98

sources: NVD: CVE-2005-2678 // JVNDB: JVNDB-2005-000494 // BID: 89387 // PACKETSTORM: 39516

AFFECTED PRODUCTS

vendor:microsoftmodel:internet information serverscope:eqversion:6.0

Trust: 1.6

vendor:microsoftmodel:internet information servicesscope:eqversion:5.0

Trust: 1.6

vendor:microsoftmodel:iisscope:eqversion:6.0

Trust: 1.1

vendor:microsoftmodel:iisscope:eqversion:5.1

Trust: 1.1

vendor:microsoftmodel:iisscope:eqversion:5.0

Trust: 0.8

vendor:microsoftmodel:internet information serverscope:eqversion:5.0

Trust: 0.6

vendor:microsoftmodel:internet information serverscope:eqversion:5.1

Trust: 0.6

sources: BID: 89387 // JVNDB: JVNDB-2005-000494 // CNNVD: CNNVD-200508-237 // NVD: CVE-2005-2678

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-2678
value: MEDIUM

Trust: 1.0

NVD: CVE-2005-2678
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200508-237
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2005-2678
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2005-000494 // CNNVD: CNNVD-200508-237 // NVD: CVE-2005-2678

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-2678

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200508-237

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200508-237

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2005-000494

PATCH
title:Top Pageurl:http://www.microsoft.com/ja/jp/default.aspx
Trust: 0.8
title:Microsoft IIS Security check bypass vulnerability repair measuresurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=134890
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2005-000494 // 
            
            
            
            CNNVD: CNNVD-200508-237

EXTERNAL IDS
db:NVDid:CVE-2005-2678
Trust: 2.7
db:SECUNIAid:16548
Trust: 2.5
db:VUPENid:ADV-2005-1503
Trust: 1.6
db:JVNDBid:JVNDB-2005-000494
Trust: 0.8
db:CNNVDid:CNNVD-200508-237
Trust: 0.6
db:BIDid:89387
Trust: 0.3
db:PACKETSTORMid:39516
Trust: 0.1
sources:
            
            
            BID: 89387 // 
            
            
            
            JVNDB: JVNDB-2005-000494 // 
            
            
            
            PACKETSTORM: 39516 // 
            
            
            
            CNNVD: CNNVD-200508-237 // 
            
            
            
            NVD: CVE-2005-2678

REFERENCES
url:http://ingehenriksen.blogspot.com/2005/08/remote-iis-5x-and-iis-60-server-name.html
Trust: 2.0
url:http://www.vupen.com/english/advisories/2005/1503
Trust: 1.6
url:http://secunia.com/advisories/16548
Trust: 1.6
url:http://marc.info/?l=bugtraq&m=112474727903399&w=2
Trust: 1.6
url:http://secunia.com/advisories/16548/
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2005-2678
Trust: 0.8
url:http://www.frsirt.com/english/advisories/2005/1503
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2005-2678
Trust: 0.8
url:http://marc.theaimsgroup.com/?l=bugtraq&m=112474727903399&w=2
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/product/39/
Trust: 0.1
url:http://secunia.com/secunia_vacancies/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/product/1438/
Trust: 0.1
sources:
            
            
            BID: 89387 // 
            
            
            
            JVNDB: JVNDB-2005-000494 // 
            
            
            
            PACKETSTORM: 39516 // 
            
            
            
            CNNVD: CNNVD-200508-237 // 
            
            
            
            NVD: CVE-2005-2678

CREDITS
Unknown
Trust: 0.3
sources:
            
            
            BID: 89387

SOURCES
db:BIDid:89387
db:JVNDBid:JVNDB-2005-000494
db:PACKETSTORMid:39516
db:CNNVDid:CNNVD-200508-237
db:NVDid:CVE-2005-2678

LAST UPDATE DATE
2024-08-14T14:35:43.524000+00:00

SOURCES UPDATE DATE
db:BIDid:89387date:2005-08-23T00:00:00
db:JVNDBid:JVNDB-2005-000494date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200508-237date:2020-11-24T00:00:00
db:NVDid:CVE-2005-2678date:2020-11-23T19:49:27.407

SOURCES RELEASE DATE
db:BIDid:89387date:2005-08-23T00:00:00
db:JVNDBid:JVNDB-2005-000494date:2007-04-01T00:00:00
db:PACKETSTORMid:39516date:2005-08-23T23:30:33
db:CNNVDid:CNNVD-200508-237date:2005-08-23T00:00:00
db:NVDid:CVE-2005-2678date:2005-08-23T04:00:00