CVE-2000-0413: Medium severity Microsoft Internet Information Services vulnerability
The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Office FrontPage (FrontPage extensions / shtml.exe)from your environment.Uninstall or disable the FrontPage extensions (shtml.exe) on affected IIS 4.0 and 5.0 servers if they are not required to eliminate the information-disclosure vulnerability.
- Configuration
Configure IIS to use custom error pages and suppress detailed error output for missing files so that the physical file system path is not revealed by error messages.
Microsoft Internet Information Services (IIS) - FrontPage extensions (shtml.exe) error message detail / custom error pages = do not disclose physical file paths; return generic error messages
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0413?
CVE-2000-0413 has been classified as having a medium severity level due to the potential exposure of sensitive information.
How do I fix CVE-2000-0413?
To mitigate CVE-2000-0413, ensure that the error messages do not reveal sensitive path information by configuring the server settings appropriately.
Which versions of IIS are affected by CVE-2000-0413?
CVE-2000-0413 affects Microsoft Internet Information Services versions 4.0 and 5.0.
Can CVE-2000-0413 be exploited remotely?
Yes, CVE-2000-0413 can be exploited remotely by attackers sending requests for non-existent files.
What is the potential impact of CVE-2000-0413?
The potential impact of CVE-2000-0413 is the exposure of the physical file paths, which could aid attackers in further exploiting the server.