CVE-2000-0071: Medium severity Microsoft Internet Information Services vulnerability
IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services (IIS)from your environment.Uninstall or remove IIS if the service is not required on the host.
- Configuration
Disable or remove the server mappings/handlers for .ida and .idq extensions in the IIS configuration to prevent disclosure of the document root pathname.
Microsoft Internet Information Services (IIS) .ida/.idq extension handling = disabled - Compensating control
Block or filter incoming HTTP requests for files with .ida and .idq extensions at the network perimeter (firewall, WAF, or reverse proxy) to prevent remote exploitation.
- Operational
Review web server logs for requests to .ida and .idq extensions to detect potential exploitation and investigate any findings.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0071?
The severity of CVE-2000-0071 is considered medium, as it allows attackers to obtain sensitive file path information.
How do I fix CVE-2000-0071?
To fix CVE-2000-0071, upgrade to a patched version of IIS or implement security measures to disable the handling of .ida and .idq file requests.
Which versions are affected by CVE-2000-0071?
CVE-2000-0071 affects Microsoft Internet Information Server versions 3.0, 4.0, and Internet Information Services 5.0.
What type of attack does CVE-2000-0071 involve?
CVE-2000-0071 involves an information disclosure attack that allows remote attackers to reveal the document root path.
Can CVE-2000-0071 be exploited remotely?
Yes, CVE-2000-0071 can be exploited remotely by sending crafted requests to the vulnerable IIS server.