NT IIS4 Shared ASP Cache Vulnerability

Bugtraq ID:	195
Class:	Unknown
CVE:
Remote:	Yes
Local:	Unknown
Published:	Jan 27 1999 12:00AM
Updated:	Jan 27 1999 12:00AM
Credit:	This vulnerability was posted to NTBugtraq mailing list by Ivan Hamilton <[email protected]>
Vulnerable:	Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack
Not Vulnerable:

NT IIS4 Shared ASP Cache Vulnerability

Two separate web servers may be configured to share the same physical directory on an IIS directory. There may be instances where ASP information containing confidential information (from site A) is presented in ASP information served to a user from site B.

NT IIS4 Shared ASP Cache Vulnerability

see discussion

NT IIS4 Shared ASP Cache Vulnerability

Solution:
Microsoft has released a patch for this problem:
http://support.microsoft.com/support/kb/articles/q197/0/03.asp?FR=0

NT IIS4 Shared ASP Cache Vulnerability

References:

• ASP Cached Data for One Site Used in Multiple Sites (Microsoft)