CVE-1999-0286: Critical severity Microsoft Internet Information Services vulnerability
In some NT web servers, appending a space at the end of a URL may allow attackers to read source code for active pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the web server to normalize incoming URLs or reject requests that include trailing spaces so that appending a space cannot be used to read source code of active pages.
NT web server URL trailing-space handling = normalize or reject trailing spaces - Configuration
Ensure the server is configured to process active pages rather than returning their source. Verify script handlers/mappings for dynamic pages (e.g., ASP) are correct and that source files cannot be served as static content.
NT web server serve_source_code_files = false - Compensating control
Until server configuration is fixed, deploy a WAF or perimeter filter rule to block or normalize requests containing trailing spaces in the URL to prevent exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0286?
The severity of CVE-1999-0286 is rated as critical with a score of 10 out of 10.
How do I fix CVE-1999-0286?
To fix CVE-1999-0286, ensure that your web server is updated to the latest version and apply any relevant patches.
What systems are affected by CVE-1999-0286?
CVE-1999-0286 affects certain versions of Microsoft Internet Information Services.
What type of vulnerability is CVE-1999-0286?
CVE-1999-0286 is a vulnerability that allows attackers to read the source code of active web pages by manipulating URLs.
What impact does CVE-1999-0286 have on a web server?
CVE-1999-0286 can lead to unauthorized access to sensitive source code, which may compromise the security of the web application.