CVE-1999-0278: Medium severity Microsoft Internet Information Server vulnerability
In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a request filtering rule in IIS to block any incoming URL that includes the sequence '::$DATA' (for example deny patterns matching '*::$DATA*'). Apply and test the rule to ensure legitimate requests are not impacted.
IIS request_filtering_rule = deny URLs containing '::$DATA' - Compensating control
Deploy a rule in the edge WAF, reverse proxy, or network appliance to block or return 403 for any HTTP request whose URL contains the sequence '::$DATA'. This prevents attackers from retrieving ASP source via appended '::$DATA'.
- Operational
Search IIS access logs for any requests containing '::$DATA' to detect potential exploitation. If source files were accessed or exposed, investigate affected hosts, restore files from known-good backups and perform incident response as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0278?
CVE-1999-0278 is considered a critical vulnerability due to the potential for remote attackers to access sensitive source code.
How do I fix CVE-1999-0278?
To fix CVE-1999-0278, you should apply the relevant security patch provided by Microsoft for Internet Information Server 3.0 or 4.0.
Which versions of IIS are affected by CVE-1999-0278?
CVE-1999-0278 affects Microsoft Internet Information Server versions 3.0 and 4.0, as well as Windows NT 4.0.
Can CVE-1999-0278 lead to data leakage?
Yes, CVE-1999-0278 can lead to data leakage as it allows attackers to retrieve source code from ASP files.
Is it safe to run IIS 3.0 or 4.0 after CVE-1999-0278 is disclosed?
Running IIS 3.0 or 4.0 without applying the security updates for CVE-1999-0278 poses significant security risks.