Title: MS IIS Internal IP Address/Internal Network Name Disclosure Vulnerability
Severity: MODERATE
Description:
A vulnerability has been discovered in Microsoft IIS that may disclose the internal IP address or internal network name to remote attackers. The vulnerability can be exploited if an attacker crafts a specially formed GET request which results in a 302 Object Moved error message.
This is achieved by browsing a web site using HTTPS, and locating a valid web directory. Once an appropriate web site is known, connecting to the host (typically on port 443) and submitting a GET request, while specifying HTTP 1.0, for the known directory. Microsoft IIS will return a 302 Object Moved error message containing the internal IP address or internal network name of the server.
For example:
GET /directory HTTP/1.0
HTTP/1.1 302 Object Moved
Location: https://IPaddress/directory/
Server: Microsoft-IIS/version number
Content-Type: text/html
Content-Length: xxx
Successful exploitation of this vulnerability could assist in further attacks against the target host.
It has been reported that a target host using HTTP is also vulnerable to this issue.
Affected Products:
- Cisco Building Broadband Service Manager 5.0.0
- Cisco Call Manager 1.0.0
- Cisco Call Manager 2.0.0
- Cisco Call Manager 3.0.0
- Cisco ICS 7750 0.0.0
- Cisco IP/VC 3540 Video Rate Matching Module 0.0.0
- Cisco Unity Server 2.0.0
- Cisco Unity Server 2.2.0
- Cisco Unity Server 2.3.0
- Cisco Unity Server 2.4.0
- Cisco uOne 1.0.0
- Cisco uOne 2.0.0
- Cisco uOne 3.0.0
- Cisco uOne 4.0.0
- Microsoft BackOffice 4.0.0
- Microsoft BackOffice 4.5.0
- Microsoft IIS 4.0.0
- Microsoft IIS 5.0
- Microsoft IIS 5.1.0
- Microsoft IIS 6.0
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server
- Microsoft Windows NT 4.0 Option Pack
- Microsoft Windows Server 2003 Datacenter Edition
- Microsoft Windows Server 2003 Datacenter Edition Itanium
- Microsoft Windows Server 2003 Enterprise Edition
- Microsoft Windows Server 2003 Enterprise Edition Itanium
- Microsoft Windows Server 2003 Standard Edition
- Microsoft Windows Server 2003 Web Edition
- Microsoft Windows XP 64-bit Edition
- Microsoft Windows XP 64-bit Edition SP1
- Microsoft Windows XP Professional
- Microsoft Windows XP Professional SP1
References:
- Microsoft: Knowledge Base Article - 218180
- Microsoft: Knowledge Base Article - 834141
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
