var-200212-0468
Vulnerability from variot

Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files. ------------ This vulnerability information is a comprehensive explanation of multiple vulnerabilities that were published at the same time. Please note that this document contains vulnerability information other than the title. ------------Microsoft IIS 5.0 There is a problem with disclosing the source of the file. Microsoft IIS 5.0 has sample files installed for demonstration purposes. IIS 5.0 of Internet Service Manager One of the sample programs used by codebrws.asp There is a file called. codebrws.asp Due to a flaw in the handling of Unicode characters in this file, an attacker could potentially use this file to obtain the source of files located under the webroot directory. default settings IIS 5.0 Now remotely codebrws.asp Unless you intentionally change the settings, only local attacks will be successful.Please refer to the "Overview" for the impact of this vulnerability. However, this script (CodeBrws.asp) does not adequately filter unicode representations of directory traversals. For example, an attacker can break out of the sample script directory by substituting '%c0%ae%c0%ae' for '..' in a dot-dot-slash directory traversal attack. It has been demonstrated that this issue may be exploited to map out the directory structure of the filesystem on a host running the vulnerable script. However, a flaw exists which will allow an additional character to be added to the file extension. This may allow an attacker to view, for example, .aspx files used by the .NET architecture. If used in conjunction with the issues discussed in BID 4525, this may expose files outside of the sample script directory

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200212-0468",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "internet information services",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "microsoft",
        "version": "5.0"
      },
      {
        "model": "microsoft iis",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8",
        "version": null
      },
      {
        "model": "microsoft iis",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8",
        "version": "5.0"
      },
      {
        "model": "iis",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "microsoft",
        "version": "5.0"
      },
      {
        "model": "internet information server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "microsoft",
        "version": "5.0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "4525"
      },
      {
        "db": "BID",
        "id": "4543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Chris Anley\u203b chrisanley@hushmail.com",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2002-1745",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2002-1745",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2002-1745",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2002-1745",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2002-1745",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2002-1745",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200212-516",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files. ------------ This vulnerability information is a comprehensive explanation of multiple vulnerabilities that were published at the same time. Please note that this document contains vulnerability information other than the title. ------------Microsoft IIS 5.0 There is a problem with disclosing the source of the file. Microsoft IIS 5.0 has sample files installed for demonstration purposes. IIS 5.0 of Internet Service Manager One of the sample programs used by codebrws.asp There is a file called. codebrws.asp Due to a flaw in the handling of Unicode characters in this file, an attacker could potentially use this file to obtain the source of files located under the webroot directory. default settings IIS 5.0 Now remotely codebrws.asp Unless you intentionally change the settings, only local attacks will be successful.Please refer to the \"Overview\" for the impact of this vulnerability.  However, this script (CodeBrws.asp) does not adequately filter unicode representations of directory traversals. For example, an attacker can break out of the sample script directory by substituting \u0027%c0%ae%c0%ae\u0027 for \u0027..\u0027 in a dot-dot-slash directory traversal attack. \nIt has been demonstrated that this issue may be exploited to map out the directory structure of the filesystem on a host running the vulnerable script. However, a flaw exists which will allow an additional character to be added to the file extension. This may allow an attacker to view, for example, .aspx files used by the .NET architecture. \nIf used in conjunction with the issues discussed in BID 4525, this may expose files outside of the sample script directory",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2002-1745"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "db": "BID",
        "id": "4525"
      },
      {
        "db": "BID",
        "id": "4543"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2002-1745",
        "trust": 3.2
      },
      {
        "db": "BID",
        "id": "4543",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "4525",
        "trust": 1.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095",
        "trust": 0.8
      },
      {
        "db": "XF",
        "id": "8853",
        "trust": 0.6
      },
      {
        "db": "NSFOCUS",
        "id": "2646",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200212-516",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "4525"
      },
      {
        "db": "BID",
        "id": "4543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "id": "VAR-200212-0468",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2024-11-22T23:12:09.506000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top\u00a0Page (( 2007/01/04\u00a0 the current \u00a0 (Information regarding this vulnerability could not be confirmed)",
        "trust": 0.8,
        "url": "http://www.microsoft.com/ja/jp/default.aspx"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-193",
        "trust": 1.0
      },
      {
        "problemtype": "Determination of boundary conditions (CWE-193) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "http://www.securityfocus.com/bid/4543"
      },
      {
        "trust": 2.0,
        "url": "http://online.securityfocus.com/archive/1/268303"
      },
      {
        "trust": 2.0,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/8853"
      },
      {
        "trust": 0.8,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-1745"
      },
      {
        "trust": 0.8,
        "url": "http://www.securityfocus.com/bid/4525"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/8853"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/2646"
      },
      {
        "trust": 0.3,
        "url": "http://online.securityfocus.com/bid/4525"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "4543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "4525"
      },
      {
        "db": "BID",
        "id": "4543"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2002-04-16T00:00:00",
        "db": "BID",
        "id": "4525"
      },
      {
        "date": "2002-04-18T00:00:00",
        "db": "BID",
        "id": "4543"
      },
      {
        "date": "2007-04-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "date": "2002-04-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      },
      {
        "date": "2002-12-31T05:00:00",
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2002-04-16T00:00:00",
        "db": "BID",
        "id": "4525"
      },
      {
        "date": "2002-04-18T00:00:00",
        "db": "BID",
        "id": "4543"
      },
      {
        "date": "2024-03-06T02:22:00",
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      },
      {
        "date": "2005-10-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200212-516"
      },
      {
        "date": "2024-11-20T23:42:00.920000",
        "db": "NVD",
        "id": "CVE-2002-1745"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "4525"
      },
      {
        "db": "BID",
        "id": "4543"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Microsoft\u00a0IIS\u00a0 of \u00a0CodeBrws.asp\u00a0 In \u00a0off-by-one\u00a0 Ella - Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2002-000095"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Input Validation Error",
    "sources": [
      {
        "db": "BID",
        "id": "4525"
      },
      {
        "db": "BID",
        "id": "4543"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.