Microsoft IIS File Enumeration Weakness

Bugtraq ID:	54251
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 30 2012 12:00AM
Updated:	Jun 30 2012 12:00AM
Credit:	Soroush Dalili
Vulnerable:	Microsoft IIS 7.5 Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 1.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft IIS File Enumeration Weakness

Microsoft IIS is prone to a file-enumeration weakness because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to enumerate the files present in the webserver's root directory; this may aid in further attacks.

Microsoft IIS File Enumeration Weakness

Attackers can exploit this issue through a browser.

Microsoft IIS File Enumeration Weakness

Solution:
Reportedly, the issue has been fixed in the latest versions of application. Please contact the vendor for more information.

Microsoft IIS File Enumeration Weakness

References:

• Microsoft IIS Homepage (Microsoft)