CVE-1999-1538: Low severity Microsoft Internet Information Server vulnerability
When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services (/scripts/iisadmin/ism.dll)from your environment.Delete the ism.dll file from the /scripts/iisadmin directory (left behind after upgrading IIS 2/3 to IIS 4) to remove the insecure component that exposes sensitive server information.
- Configuration
Configure IIS and filesystem permissions so the /scripts/iisadmin directory and ism.dll are accessible only from the local machine (restrict remote access).
Microsoft Internet Information Services (/scripts/iisadmin/ism.dll) access_restriction = restrict to local machine - Operational
Rotate the Administrator password and any other credentials that may have been exposed; review audit logs for unauthorized access and take further remediation as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1538?
CVE-1999-1538 is classified as a high severity vulnerability due to potential unauthorized access to sensitive server information.
How do I fix CVE-1999-1538?
To fix CVE-1999-1538, remove the ism.dll file from the /scripts/iisadmin directory after upgrading to IIS 4.
What systems are affected by CVE-1999-1538?
CVE-1999-1538 affects systems running Microsoft Internet Information Server 4.0 that were upgraded from IIS 2 or 3.
What can an attacker do with CVE-1999-1538?
An attacker exploiting CVE-1999-1538 can gain access to sensitive server information, including the Administrator's password.
Is CVE-1999-1538 still relevant today?
While CVE-1999-1538 is an older vulnerability, it remains relevant for legacy systems that have not been updated or correctly configured.