ID de Prueba:	1.3.6.1.4.1.25623.1.0.10492
Categoría:	Windows : Microsoft Bulletins
Título:	Microsoft IIS IDA/IDQ Path Disclosure Vulnerability (MS00-006) - Active Check
Resumen:	IIS 4.0 allows a remote attacker to obtain the real pathname of; the document root by requesting non-existent files with .ida or .idq extensions.
Descripción:	Summary: IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions. Vulnerability Impact: An attacker may use this flaw to gain more information about the remote host, and hence make more focused attacks. Solution: Select 'Preferences ->Home directory ->Application', and check the checkbox 'Check if file exists' for the ISAPI mappings of your server. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2000-0071 Bugtraq: 20000111 IIS still revealing paths for web directories (Google Search) http://marc.info/?l=bugtraq&m=94770020309953&w=2 Bugtraq: 20000113 SV: IIS still revealing paths for web directories (Google Search) http://marc.info/?l=bugtraq&m=94780058006791&w=2 Common Vulnerability Exposure (CVE) ID: CVE-2000-0097 BugTraq ID: 950 http://www.securityfocus.com/bid/950 Microsoft Security Bulletin: MS00-006 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-006 http://www.osvdb.org/1210 XForce ISS Database: http-indexserver-dirtrans Common Vulnerability Exposure (CVE) ID: CVE-2000-0098 Common Vulnerability Exposure (CVE) ID: CVE-2000-0302 BugTraq ID: 1084 http://www.securityfocus.com/bid/1084 Bugtraq: 20000331 Alert: MS Index Server (CISADV000330) (Google Search) http://marc.info/?l=bugtraq&m=95453598317340&w=2 http://www.osvdb.org/271 XForce ISS Database: http-indexserver-asp-source
Copyright	Copyright (C) 2000 Filipe Custodio

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.