CVE-2000-0126: Medium severity Microsoft Internet Information Server vulnerability
Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services - Sample Internet Data Query (IDQ) scriptsfrom your environment.Remove/uninstall the sample Internet Data Query (IDQ) scripts from affected IIS 3 and IIS 4 installations (delete or rename the sample IDQ script files) if they are not required.
- Compensating control
Until the sample IDQ scripts are removed or patched, restrict access to them (for example, block access to the script directory or allow access only from trusted IP addresses via firewall rules or IIS access controls) to prevent remote file-read exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0126?
The severity of CVE-2000-0126 is considered high due to the potential for unauthorized access to sensitive files.
How do I fix CVE-2000-0126?
To fix CVE-2000-0126, it is recommended to upgrade to a version of Internet Information Server that is not affected by this vulnerability.
Which versions of IIS are affected by CVE-2000-0126?
CVE-2000-0126 affects Microsoft Internet Information Server versions 3.0 and 4.0.
What type of attack is described in CVE-2000-0126?
CVE-2000-0126 describes a dot dot attack, which exploits the ability to read files by manipulating directory paths.
Can CVE-2000-0126 be exploited remotely?
Yes, CVE-2000-0126 can be exploited remotely, allowing attackers to read files without proper authorization.