CVE-1999-0725: High severity Microsoft Internet Information Server vulnerability
When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a. "Double Byte Code Page".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the IIS server default language/code page to a language other than Chinese, Korean, or Japanese to avoid exposure of source code via the double byte code page issue.
Microsoft Internet Information Services default language = not Chinese, Korean, or Japanese
Event History
Frequently Asked Questions
What vulnerabilities are associated with CVE-1999-0725?
CVE-1999-0725 allows remote attackers to view the source code of certain files in IIS when using a default language of Chinese, Korean, or Japanese.
Which versions of Internet Information Server are affected by CVE-1999-0725?
IIS versions 3.0 and 4.0 are affected by CVE-1999-0725 when set to a default language of Chinese, Korean, or Japanese.
What is the impact of CVE-1999-0725?
The impact of CVE-1999-0725 is the exposure of source code, which can lead to further exploitation of the web application.
How can I mitigate CVE-1999-0725?
Mitigating CVE-1999-0725 can be achieved by changing the default language settings away from Chinese, Korean, or Japanese in IIS.
Is there a patch available for CVE-1999-0725?
Yes, Microsoft provides patches and updates to address vulnerabilities like CVE-1999-0725 in supported versions of Internet Information Server.