CVE-2000-0115: Medium severity microsoft internet information server vulnerability
IIS allows local users to cause a denial of service via invalid regular expressions in a Visual Basic script in an ASP page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If your applications do not require classic ASP or VBScript, disable ASP and/or Visual Basic Scripting support in IIS to prevent local users from triggering the vulnerability via ASP pages.
Microsoft Internet Information Services ASP/VBScript execution = disabled (if not required) - Compensating control
Restrict local user accounts and privileges on the server running IIS. Ensure only trusted administrative accounts can create, upload, or execute ASP pages or scripts to prevent unprivileged local users from causing a denial of service.
- Compensating control
Monitor Microsoft advisories and apply the official security update or patch for Internet Information Services addressing this issue as soon as it is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0115?
CVE-2000-0115 has a moderate severity level due to its potential to cause denial of service.
How do I fix CVE-2000-0115?
To fix CVE-2000-0115, validate regular expressions in Visual Basic scripts and update the IIS to newer, secure versions.
Which versions of IIS are affected by CVE-2000-0115?
CVE-2000-0115 affects multiple versions of Microsoft Internet Information Server, specifically versions prior to patches addressing this issue.
What impact does CVE-2000-0115 have on web applications?
CVE-2000-0115 can lead to a denial of service, causing the application to become unresponsive.
Are there any workarounds for CVE-2000-0115?
A potential workaround for CVE-2000-0115 includes disabling any ASP scripts or limiting the use of user input in regular expressions.