s0nIc
February 14th, 2002, 06:21 AM
Microsoft IIS 5.1 Frontpage Extensions Path Disclosure Information Vulnerabil
An issue has been reported that a number of configuration files (.cnf) in Microsoft IIS 5.1, could be used to disclose sensitive system information to remote users.
Allegedly, submitting a request for one of the vulnerable files by way of '/_vti_pvt/', will cause the host to reveal system path information. The reported problematic files are 'access.cnf', 'botinfs.cnf', 'bots.cnf' and 'linkinfo.cnf'.
Microsoft has not confirmed the existence of these vulnerabilities.
Remote: Yes
Exploit: No exploit code is required.
An issue has been reported that a number of configuration files (.cnf) in Microsoft IIS 5.1, could be used to disclose sensitive system information to remote users.
Allegedly, submitting a request for one of the vulnerable files by way of '/_vti_pvt/', will cause the host to reveal system path information. The reported problematic files are 'access.cnf', 'botinfs.cnf', 'bots.cnf' and 'linkinfo.cnf'.
Microsoft has not confirmed the existence of these vulnerabilities.
Remote: Yes
Exploit: No exploit code is required.