|
|
Vulnerability Assessment & Network Security Forums |
|||||||||
|
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Remote file access >> Test Microsoft IIS Source Fragment Disclosure Vulnerability Assessment Details
|
Test Microsoft IIS Source Fragment Disclosure |
||
|
Test Microsoft IIS Source Fragment Disclosure Detailed Explanation for this Vulnerability Assessment Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be inaccessible. This is done by appending +.htr to a request for a known .asp (or .asa, .ini, etc) file. Solution : .htr script mappings should be removed if not required. - open Internet Services Manager - right click on the web server and select properties - select WWW service | Edit | Home Directory | Configuration - remove the application mappings reference to .htr If .htr functionality is required, install the relevant patches from Microsoft (MS01-004) See also: http://www.microsoft.com/technet/security/bulletin/MS01-004.mspx Network Security Threat Level: High Networks Security ID: 1193, 1488 Vulnerability Assessment Copyright: This script is Copyright (C) 2001 Pedro Antonio Nieto Feijoo |
||
|
Workstations, Terminals |
|
||
|
No Discussions have been posted on this vulnerability. |