Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities

Bugtraq ID:	8244
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jul 22 2003 12:00AM
Updated:	Jul 22 2003 12:00AM
Credit:	Discovery of these issues is credited to Hugo Vázquez Caramés & Toni Cortés Martínez.
Vulnerable:	Microsoft IIS 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition
Not Vulnerable:

Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities

Multiple vulnerabilities have been reported in the web admin interface that is included in Microsoft IIS 6.0. This includes multiple instances of cross-site scripting vulnerabilities. Additionally, it is reported that the web admin interface could expose valid session IDs or permit unauthorized access to areas that do not require session IDs.

Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities

There is no exploit required.

Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities

References:

• IIS 6.0 Web Admin Multiple vulnerabilities (Hugo "Vázquez" "Caramés" )