CVE-2000-0071 in IIS
Summary
by MITRE
IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2025
This vulnerability exists in Microsoft Internet Information Services version 4.0 and represents a significant information disclosure flaw that exposes the underlying file system structure of web servers. The issue stems from how IIS 4.0 handles requests for non-existent files with specific extensions, particularly .ida and .idq, which are associated with internet database files used by the server. When an attacker submits a request for a non-existent file with these extensions, the server inadvertently reveals the actual document root path through its error response mechanism, providing attackers with crucial information about the server's file system hierarchy.
The technical implementation of this vulnerability exploits the server's handling of Active Server Pages and database access components. When IIS 4.0 encounters a request for a non-existent file with .ida or .idq extensions, it processes the request through its internal database query mechanisms and returns an error message that contains the absolute file path where the server expects to find these database files. This occurs because the server's error handling routine does not properly sanitize the output of internal database operations, allowing the real file system path to leak through error messages. The vulnerability is classified under CWE-200, Information Exposure, and aligns with ATT&CK technique T1213.002 for Data from Information Repositories, as it provides adversaries with critical infrastructure information.
The operational impact of this vulnerability is substantial as it enables attackers to map the server's file system structure without requiring any authentication or privileged access. An attacker can systematically probe the server using various .ida and .idq extensions to discover not only the document root but also potentially sensitive directory structures that might contain additional vulnerabilities or confidential data. This information leakage significantly reduces the attack surface by providing attackers with precise knowledge of the server's internal organization, making subsequent attacks more effective. The vulnerability particularly affects environments where IIS 4.0 is deployed on Windows NT 4.0 or Windows 2000 servers, creating opportunities for attackers to identify other potential attack vectors such as misconfigured directories or sensitive files that might be accessible through the discovered path structure.
Mitigation strategies for this vulnerability include applying the appropriate security patches released by Microsoft, which address the improper error handling mechanism in the IIS 4.0 server. Organizations should also implement proper input validation and output sanitization to prevent information leakage through error messages. Network segmentation and firewall rules can help limit access to vulnerable servers, while regular security audits should be conducted to identify similar information disclosure vulnerabilities in other components. Additionally, implementing web application firewalls and security monitoring systems can help detect and block malicious probing attempts that exploit this vulnerability, as the pattern of requests using .ida and .idq extensions is easily identifiable and should be flagged as suspicious activity. The vulnerability demonstrates the importance of proper error handling practices and aligns with security best practices outlined in NIST SP 800-53 and ISO 27001 controls related to information security and access control.