CVE-1999-0407: Critical severity Microsoft Internet Information Server vulnerability
By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or disable the /IISADMPWD virtual directory to prevent access to files that can be used as proxies for brute force password attacks or to enumerate valid users.
Microsoft Internet Information Services (IIS 4.0) virtual directory /IISADMPWD = disabled or removed
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0407?
CVE-1999-0407 is considered a high severity vulnerability due to its potential to facilitate brute force password attacks.
How do I fix CVE-1999-0407?
To fix CVE-1999-0407, it is recommended to disable the /IISADMPWD virtual directory in IIS 4.0.
What are the risks associated with CVE-1999-0407?
The risks associated with CVE-1999-0407 include unauthorized access attempts and the exposure of valid user accounts.
What versions of software are affected by CVE-1999-0407?
CVE-1999-0407 affects Microsoft Internet Information Server version 4.0.
Can CVE-1999-0407 be exploited remotely?
Yes, CVE-1999-0407 can be exploited remotely, making it crucial to apply necessary security measures.