CVE-1999-0253: High severity Microsoft Internet Information Server vulnerability
IIS 3.0 with the iis-fix hotfix installed allows remote intruders to read source code for ASP programs by using a %2e instead of a . (dot) in the URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services 3.0 - iis-fix hotfixfrom your environment.Uninstall the iis-fix hotfix from Microsoft Internet Information Services (IIS) 3.0 to prevent remote disclosure of ASP source code via encoded dot (%2e) URLs.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0253?
CVE-1999-0253 is considered a critical vulnerability as it allows remote attackers to read the source code of ASP programs.
How do I fix CVE-1999-0253?
To fix CVE-1999-0253, you should apply the relevant patches or updates provided by Microsoft for Internet Information Server (IIS) 3.0.
What software is affected by CVE-1999-0253?
CVE-1999-0253 affects Microsoft Internet Information Server versions 1.0, 2.0, and 3.0.
How can attackers exploit CVE-1999-0253?
Attackers can exploit CVE-1999-0253 by using a URL encoding technique, specifically replacing the dot (.) with %2e to access ASP source code.
Is CVE-1999-0253 still a threat today?
Although CVE-1999-0253 primarily affects outdated versions of IIS, systems still running these versions without proper updates remain at risk.