Microsoft IIS 4.0/5.0 Error Message cross site scripting

Summaryinfo

A vulnerability was found in Microsoft IIS 4.0/5.0. It has been declared as critical. This affects an unknown part of the component Error Message Handler. The manipulation results in cross site scripting. This vulnerability is known as CVE-2000-1104. It is possible to launch the attack remotely. No exploit is available. This vulnerability is historically impactful due to its background and the reception it garnered. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Microsoft IIS 4.0/5.0 (Web Server). It has been classified as critical. Affected is some unknown processing of the component Error Message Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site.

The weakness was published 01/09/2001 as MS00-060 as confirmed bulletin (Technet). The advisory is shared for download at microsoft.com. This vulnerability is traded as CVE-2000-1104. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/11/2024). The MITRE ATT&CK project declares the attack technique as T1059.007. This vulnerability has a historic impact due to its background and reception.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 10562 (Microsoft FrontPage/IIS Cross Site Scripting shtml.dll (MS00-060)).

Applying the patch MS00-060 is able to eliminate this problem. The bugfix is ready for download at microsoft.com. Attack attempts may be identified with Snort ID 1007.

The vulnerability is also documented in the databases at SecurityFocus (BID 1595†) and Vulnerability Center (SBV-853†). Similar entry is available at VDB-15888. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• Microsoft

Name

• IIS

Version

• 4.0
• 5.0

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion