CVE-2000-0114: Medium severity Microsoft Internet Information Server vulnerability
Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /vtibin/ virtual directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
FrontPage Server Extensionsfrom your environment.Uninstall or remove FrontPage Server Extensions from the IIS server if the feature is not required.
- Configuration
Disable FrontPage Server Extensions in IIS Manager (or via server roles/feature removal) to prevent disclosure via shtml.dll in the /_vti_bin/ virtual directory.
Microsoft Internet Information Services (FrontPage Server Extensions) FrontPage Server Extensions = disabled - Configuration
Remove or disable the shtml.dll ISAPI/handler mapping and block HTTP POST requests to shtml.dll in the /_vti_bin/ virtual directory to prevent RPC POST-based disclosure.
IIS / _vti_bin/ virtual directory Access to shtml.dll = disabled - Compensating control
Restrict access to the /_vti_bin/ virtual directory and shtml.dll to trusted IP addresses or management networks using firewall rules, network ACLs, or a web application firewall to prevent remote attackers from reaching the endpoint.
- Operational
Change or audit the anonymous account used for IIS anonymous access (rename or replace the account), and review server logs for suspicious RPC POSTs to /_vti_bin/shtml.dll to detect possible exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0114?
CVE-2000-0114 is considered a medium severity vulnerability as it can disclose sensitive information about the anonymous account.
How do I fix CVE-2000-0114?
To fix CVE-2000-0114, it's recommended to disable the Frontpage Server Extensions or apply security patches provided by Microsoft.
Who is affected by CVE-2000-0114?
CVE-2000-0114 affects users of Microsoft Internet Information Server versions 3.0 and 4.0 with Frontpage Server Extensions enabled.
What does CVE-2000-0114 exploit?
CVE-2000-0114 exploits a vulnerability in the RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.
Can CVE-2000-0114 be exploited remotely?
Yes, CVE-2000-0114 can be exploited remotely by attackers to determine the name of the anonymous account.