CVE
- Id
- 1649
- CVE No.
- CVE-2000-0071
- Status
- Candidate
- Description
- IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.
- Phase
- Proposed (20000125)
- Votes
- ACCEPT(2) LeBlanc, Levy | MODIFY(1) Frech | NOOP(1) Baker | REJECT(1) Christey
- Comments
- Frech> XF:iis-ida-idq-paths | Christey> Consider adding: | ADDREF BID:1065 | BUGTRAQ:20000309 Enumerate Root Web Server Directory Vulnerability for IIS 4.0 | Are there really 2 different threads on the same problem? | | Also consider XF:iis-root-enum | | May also be a dupe of CVE-1999-0450 (BID:194) | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> Appears to be a duplicate of CVE-2000-0098. Confirm with | Microsoft, and if it is a duplicate, then REJECT this | candidate. | CHANGE> [Christey changed vote from REVIEWING to REJECT] | Christey> Confirmed duplicate by Microsoft. | Christey> iis-ida-idq-paths(4346) is obsolete; ensure | http-indexserver-path(3890) is added to CVE-2000-0098.
