CVE-2000-0970: High severity Microsoft Internet Information Services vulnerability

Published Dec 19, 2000

Updated

IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

Affected Software

2 affected components

Microsoft Internet Information Services=5.0

Microsoft Internet Information Server=4.0

Event History

Dec 19, 2000

CVE Published

05:00 AM

Jan 22, 2001

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0970?

CVE-2000-0970 is considered a critical vulnerability as it allows remote attackers to hijack secure web sessions.

How do I fix CVE-2000-0970?

Users should upgrade to a later version of Microsoft Internet Information Services that is not affected by this vulnerability.

What are the affected versions in CVE-2000-0970?

CVE-2000-0970 affects Microsoft Internet Information Server version 4.0 and Microsoft Internet Information Services version 5.0.

What is the impact of CVE-2000-0970 on users?

CVE-2000-0970 could lead to unauthorized access to secure sessions, compromising user data and security.

Is CVE-2000-0970 exploitable remotely?

Yes, CVE-2000-0970 is exploitable remotely, allowing attackers to perform session hijacking.