Microsoft URLScan Tool Information Disclosure Vulnerability
BID:8101
Info
Microsoft URLScan Tool Information Disclosure Vulnerability
| Bugtraq ID: | 8101 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 03 2003 12:00AM |
| Updated: | Jul 03 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to John Madden <[email protected]>. |
| Vulnerable: |
Microsoft URLScan 2.5 |
| Not Vulnerable: | |
Discussion
Microsoft URLScan Tool Information Disclosure Vulnerability
Microsoft URLScan has been reported prone to an information disclosure vulnerability in some server configurations.
It has been reported that a remote attacker may disclose accurate IIS server HTTP header information, regardless of whether the server is protected by the URLScan tool. The issue presents itself when an attacker makes a HTTPS request to an IIS server that is HTTPS enabled. A partial header will be returned to the attacker containing potentially sensitive version information.
Microsoft URLScan has been reported prone to an information disclosure vulnerability in some server configurations.
It has been reported that a remote attacker may disclose accurate IIS server HTTP header information, regardless of whether the server is protected by the URLScan tool. The issue presents itself when an attacker makes a HTTPS request to an IIS server that is HTTPS enabled. A partial header will be returned to the attacker containing potentially sensitive version information.
Exploit / POC
Microsoft URLScan Tool Information Disclosure Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Microsoft URLScan Tool Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.