|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
The ISAPI extension idq.dll library in Microsoft's IIS web server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker requests any file which does not exist with an .ida or .idq extension, which will disclose the full path of the web server's document root, resulting in a loss of confidentiality.
|
|
Classification |
Location:
Local Access Required,
Remote/Network Access Required
Attack Type:
Information Disclosure,
Input Manipulation,
Misconfiguration
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Solution |
In the IIS Microsoft Management Console, go to Preferences -> Home directory -> Application, and select 'Check if file exists'. Additionally, please apply the patches listed in Microsoft Knowledge Base article MS00-006.
|
|
Products |
|
IIS
 |
3.0 |
4.0 |
5.0 |
|
|
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
