CVE-2000-0970
First published: Tue Dec 19 2000(Updated: )
IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Information Services (IIS) | =5.0 | |
| Microsoft Internet Information Services | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2000-0970?
CVE-2000-0970 is considered a critical vulnerability as it allows remote attackers to hijack secure web sessions.
How do I fix CVE-2000-0970?
Users should upgrade to a later version of Microsoft Internet Information Services that is not affected by this vulnerability.
What are the affected versions in CVE-2000-0970?
CVE-2000-0970 affects Microsoft Internet Information Server version 4.0 and Microsoft Internet Information Services version 5.0.
What is the impact of CVE-2000-0970 on users?
CVE-2000-0970 could lead to unauthorized access to secure sessions, compromising user data and security.
Is CVE-2000-0970 exploitable remotely?
Yes, CVE-2000-0970 is exploitable remotely, allowing attackers to perform session hijacking.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- vendor/microsoft
- product/internet information services
- product/internet information server
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/microsoft internet information services (iis)
- version/microsoft internet information services (iis)/5.0
- canonical/microsoft internet information services
- version/microsoft internet information services/4.0