CVE-1999-1223: Medium severity Microsoft Internet Information Server vulnerability
IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (forward slash) characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable ASP (Active Server Pages) if it is not required to eliminate the attack surface for requests that can cause a denial of service via URLs with many '/' characters.
Microsoft Internet Information Services (IIS 3.0) - ASP Active Server Pages (ASP) enabled = false - Compensating control
Deploy filtering at the network perimeter, WAF, or reverse proxy to block or normalize requests that contain an excessive number of consecutive '/' characters or otherwise abnormally long/ malformed URLs to mitigate the DoS against ASP pages.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1223?
The severity of CVE-1999-1223 is classified as a denial of service vulnerability that can affect the availability of the IIS 3.0 server.
How do I fix CVE-1999-1223?
To fix CVE-1999-1223, you should update your software to a version of Internet Information Server that is not vulnerable and apply all security patches.
What versions of IIS are affected by CVE-1999-1223?
CVE-1999-1223 specifically affects Microsoft Internet Information Server 3.0.
Can CVE-1999-1223 be exploited remotely?
Yes, CVE-1999-1223 can be exploited remotely by attackers sending specially crafted requests to the server.
What is the impact of CVE-1999-1223 on web applications?
The impact of CVE-1999-1223 is that it can lead to service disruptions, causing denial of service for users attempting to access web applications hosted on the affected server.