CVE-2000-0649 : Detail

CVE-2000-0649

A01-Broken Access Control
34.9%V4
Network
2000-08-03
02h00 +00:00
2003-05-08
07h00 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Metrics

Metrics Score Severity CVSS Vector Source
V2 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 20096

Publication date : 2000-07-12 22h00 +00:00
Author : Dougal Campbell
EDB Verified : Yes

source: https://www.securityfocus.com/bid/1499/info When a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 1.0, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host. Even if IIS is behind a firewall or NAT, it will disclose the true internal IP address to the remote user. The internal IP address may also be revealed through a HTTP request made with an empty host name. If a PROPFIND HTTP request is made, the message returned will include the IP address as part of the HREF header. The IP address may also be exposed through the WRITE or MKCOL methods, although they would not normally be exposed to the external network. Eg. telnet target 80 Trying target... Connected to target. Escape character is '^]'. HEAD /directory HTTP/1.0[CRLF] [CRLF] HTTP/1.1 401 Access Denied WWW-Authenticate: Basic realm="<Internal IP Address>" Content-Length: 644 Content-Type: text/html

Products Mentioned

Configuraton 0

Microsoft>>Internet_information_server >> Version 3.0

Microsoft>>Internet_information_server >> Version 4.0

Microsoft>>Internet_information_services >> Version 2.0

Microsoft>>Internet_information_services >> Version 5.0

References

http://www.securityfocus.com/bid/1499
Tags : vdb-entry, x_refsource_BID