Title: Microsoft IIS Appended Dot Script Source Disclosure Vulnerability
Severity: MODERATE
Description:
Microsoft Internet Information Server (IIS) is a popular web server, providing support for a variety of scripting languages, including ASP (active server pages). IIS 2.0 and 3.0 suffer from an issue allowing a remote user to retrieve the source code for any script (that has read permissions on the server) via a web browser. This is accomplished by appending a period (.) to the end of a URL requesting a specific script, and applies to any file types in the "script-map list", including .asp, .ht., .id, .PL, and others. Consequences of exploitation vary depending on the site design, but commonly include details of directory structure on the web server, database passwords, and various other pieces of information that could then be used to mount further attacks. A Microsoft hotfix for this issue was released, but has been found vulnerable to a variation whereby the period is replaced by %2e, the hexadecimal encoding for the same character. (BugTraq ID 1814).
Affected Products:
- Microsoft IIS 2.0.0
- Microsoft IIS 3.0.0
- Microsoft Windows NT 4.0
References:
- Microsoft: Q163485: Active Server Pages Script Appears in Browser
- Microsoft: Q164059: IIS Execution File Text Can Be Viewed in Client
- SecurityFocus: Microsoft IIS 3.0 "%2e" ASP Source Disclosure Vulnerability
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
