CVE-2003-1567: Infoleak
The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1567?
CVE-2003-1567 is considered a medium severity vulnerability due to its potential for exposing sensitive information.
How do I fix CVE-2003-1567?
To mitigate CVE-2003-1567, disable the TRACK method in Microsoft Internet Information Services 5.0 or upgrade to a later version.
What does CVE-2003-1567 exploit?
CVE-2003-1567 exploits the TRACK method in IIS 5.0, allowing attackers to retrieve sensitive data from the original request.
Which versions of IIS are affected by CVE-2003-1567?
CVE-2003-1567 affects Microsoft Internet Information Services version 5.0.
What impact does CVE-2003-1567 have on security?
CVE-2003-1567 can lead to the theft of cookies and authentication credentials, significantly impacting web application security.