CVE-1999-1375: Medium severity Microsoft Internet Information Server vulnerability
FileSystemObject (FSO) in the showfile.asp Active Server Page (ASP) allows remote attackers to read arbitrary files by specifying the name in the file parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services/showfile.aspfrom your environment.Remove or rename the vulnerable showfile.asp page from the web server to eliminate the arbitrary-file-read vector. If the functionality is required, replace it with a secure implementation that validates and sanitizes the 'file' parameter before use.
- Configuration
Disable ASP scripting or remove execute permissions for .asp files (or for the directory containing showfile.asp) if ASP pages are not required, to prevent exploitation of the vulnerable page.
Microsoft Internet Information Services ASP execution = disabled - Compensating control
Restrict access to the affected page or directory until a secure fix is in place — for example, limit access by IP at the network firewall or IIS, require authentication/authorization via web.config or IIS access controls, or place the resource behind a VPN or WAF.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1375?
CVE-1999-1375 is considered a critical vulnerability due to the potential for arbitrary file reading.
How does CVE-1999-1375 affect affected software?
CVE-1999-1375 impacts Microsoft Internet Information Server versions 3.0 and 4.0, allowing attackers to read sensitive files.
What are the potential consequences of exploiting CVE-1999-1375?
Exploitation of CVE-1999-1375 can lead to unauthorized access to confidential data stored on the server.
How do I fix CVE-1999-1375?
To fix CVE-1999-1375, you should apply the latest patches provided by Microsoft for Internet Information Server.
Who is primarily affected by CVE-1999-1375?
Organizations using Microsoft Internet Information Server 3.0 or 4.0 are primarily affected by CVE-1999-1375.