13430 : Microsoft IIS aexp4.htr Password Policy Bypass
Printer | http://osvdb.org/13430 | Email This | Edit Vulnerability

Views This Week

2

Views All Time

82

Info

Last Modified

10 months ago

Percent Complete

100%

Disclosure

Mar 06, 2002

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Microsoft IIS installs the /iisadmpwd/aexp4.htr file by default, which can be used by an attacker to brute force a valid username/password. A valid user may also use it to change a password on a locked account or bypass the administrator security policy "user cannot change password".

Classification

Location: Remote/Network Access Required
Attack Type: Misconfiguration
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: Remove the HTR ISAPI filter mapping from IIS and use Microsoft Active Directory Service Interfaces (ADSI) for handling accounts remotely.

Products

Microsoft Corporation	Windows	NT 4.0
Microsoft Corporation	Internet Information Server	4.0

References

Related OSVDB ID: 13427 13428 13429
CVE ID: 2002-0421 (see also: NVD)
Bugtraq ID: 4236
ISS X-Force ID: 8388
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2002-03/0049.html

Tools & Filters

Nikto	1492 1493 1494 1495 1496
Nessus	10371
Snort	1487

Credit

Syed Mohamed A - syedmsyedmainnerframe.com - InnerFrame

Blogs

Provided by Technorati

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

User Status

Account
- Login
- Sign-Up

Quick Searches

Advertisements

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2008 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use