CVE-1999-0154: Medium severity Microsoft Internet Information Server vulnerability
IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services (IIS) 2.0/3.0from your environment.Uninstall or stop running Internet Information Services (IIS) versions 2.0 and 3.0. Migrate hosted applications to a supported web server or a newer, supported IIS release.
- Configuration
Add an IIS URL Rewrite rule or configure request filtering to reject requests whose path ends with a trailing dot ('.'), returning 403/404 to prevent retrieval of ASP source by appending a dot to the URL.
Microsoft Internet Information Services (IIS) URL rewrite / request filtering = block URLs ending with '.' - Compensating control
Deploy a perimeter control (WAF, reverse proxy, or firewall) rule to detect and block HTTP requests with a trailing dot in the URL path, dropping or returning an error response for such requests to mitigate exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0154?
The severity of CVE-1999-0154 is considered to be high due to the potential for remote attackers to exploit the vulnerability.
How do I fix CVE-1999-0154?
To fix CVE-1999-0154, upgrade to a later version of Internet Information Server that does not allow for source code exposure.
What versions of IIS are affected by CVE-1999-0154?
CVE-1999-0154 affects Microsoft Internet Information Server versions 2.0 and 3.0.
What kind of attacks can exploit CVE-1999-0154?
CVE-1999-0154 can be exploited by remote attackers to access and read the source code of ASP pages.
Is CVE-1999-0154 a local or remote vulnerability?
CVE-1999-0154 is classified as a remote vulnerability, as it can be exploited over the network.