|
|
Info |
Last Modified |
| 8 months ago |
|
|
|
|
Description |
Microsoft Site Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when using the 'LDAP_Anonymous' account and accessing the 'vs.asp' script, which will disclose certain LDAP service and backend configuration parameters resulting in a loss of confidentiality. While not considered critical, this information can lead to more focused and precise attacks.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Technical |
The patch prevents the 'LDAP_Anonymous' account from accessing these scripts. However, a valid NT account is still able to disclose the information.
|
|
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.
|
|
Products |
|
Site Server
 |
3.0 Standard Edition |
3.0 Commerce Edition |
|
|
|
|
|
|
Credit |
- RFP - rfp
 wiretrip.net - RFP Labs
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
