medium5.0Public exploit code
CVE-2000-0246
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft IIS 4.0 - UNC Mapped Virtual Host2000-03-30 · remote · multiple · Verified
Impact
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Commercial Internet System | Versions 2.0, 2.5 |
| Microsoft | Internet Information Server | Version 4.0 |
| Microsoft | Internet Information Services | Version 5.0 |
| Microsoft | Proxy Server | Version 2.0 |
| Microsoft | Site Server | Version 3.0 |
| Microsoft | Site Server Commerce | Version 3.0 |
References
- NVD record
- CVE.org record
- http://www.microsoft.com/technet/support/kb.asp?ID=249599
- http://www.securityfocus.com/bid/1081
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019
- http://www.microsoft.com/technet/support/kb.asp?ID=249599
- http://www.securityfocus.com/bid/1081
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-019